topic How to group results from two rex together into one Column Chart? in Splunk Search

How to group results from two rex together into one Column Chart?

lordhans — Tue, 14 Nov 2017 20:32:54 GMT

I am doing a search query where there will be a dynamic client ID with either a success or a failure result code -- I want to look at all the successes and failures based on a client ID.

The client ID always comes after the method name, a comma, the code (for success or failure), a space and comma, then the client ID followed by a comma. This is an example of what the event logs look like:

<A bunch of random logging stuff> ~aStaticMethodName,SuccessOrFailureCode5555 ,ClientID, <Another bunch of random logging stuff>

I am using 'rex' to find the Client IDs for both the successes or failures by client ID like this:

"My Search Here" 
| rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
| rex "~myMethod,failureCode1111 ,(?<failure>[^,]+),"

I then add a | chart count by success (or change the success to failure) and can get an output looking like this:

The successes and failures will have common client IDs (client A, client B, etc).

What I want to do, is combine both success and failure into one chart grouped by client ID like this:

Is there a way to do this in Splunk? Help is greatly appreciated!

Re: How to group results from two rex together into one Column Chart?

cmerriman — Tue, 14 Nov 2017 20:40:35 GMT

try something like this:

"My Search Here" 
 | rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
 | rex "~myMethod,failureCode1111 ,(?<failure>[^,]+)," 
 | eval clients=coalesce(success,failure)
 | stats count(success) as success count(failure) as failure by clients

Re: How to group results from two rex together into one Column Chart?

somesoni2 — Tue, 14 Nov 2017 20:40:48 GMT

Try like this

"My Search Here" 
 | rex "~myMethod,(?<status>[^,]+) ,(?<clientID>[^,]+)," 
 | replace "successCode0000" with "Success" "failureCode1111" with "Failure" in status
| chart count over clientID by status