https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589029#M205135 <P>Actually, the correct code should be</P><LI-CODE lang="markup">| timechart count by status</LI-CODE><P>where status can have three values success, failed, and warning.</P><P>Can you describe your data and how to tell whether status is success, failed, or warning? &nbsp;Without these, everything is just guesswork.</P> Tue, 15 Mar 2022 07:04:49 GMT yuanliu 2022-03-15T07:04:49Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589004#M205124 <P>I am trying to fetch data of weekly successful, failed and warning event counts. I want 5 days data to be shown daywise on line chart. I am using this query. I need modification to show it on line chart which represents date and count of successful, failed and warning events.</P> <P>Query:</P> <LI-CODE lang="markup">index=outputsolutions host=*dxr22* Error | bin _time span=1d | stats count as dailycount by _time</LI-CODE> Tue, 15 Mar 2022 03:19:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589004#M205124 athark20 2022-03-15T03:19:01Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589007#M205126 <P>Do you mean&nbsp;<A href="https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Timechart" target="_blank" rel="noopener">timechart</A>?</P><LI-CODE lang="markup">| timechart span=1d count by successful failed warning</LI-CODE><P>Obviously you'll need to define "successful", "failed", and "warning" in your search&nbsp;</P> Tue, 15 Mar 2022 03:42:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589007#M205126 yuanliu 2022-03-15T03:42:58Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589008#M205127 <P>Can you please help in writing it for me I am a newbie in splunk</P> Tue, 15 Mar 2022 03:51:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589008#M205127 athark20 2022-03-15T03:51:10Z https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589029#M205135 <P>Actually, the correct code should be</P><LI-CODE lang="markup">| timechart count by status</LI-CODE><P>where status can have three values success, failed, and warning.</P><P>Can you describe your data and how to tell whether status is success, failed, or warning? &nbsp;Without these, everything is just guesswork.</P> Tue, 15 Mar 2022 07:04:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-fetch-weekly-data-of-success-failed-and-warning-events/m-p/589029#M205135 yuanliu 2022-03-15T07:04:49Z