topic Re: How to breakdown errors in charts group by error codes in error tables or list? in Splunk Search

How to breakdown errors in charts group by error codes in error tables or list?

Khanu89 — Thu, 21 Apr 2022 22:12:17 GMT

Hello - I am a new Splunk user and learning as I go. My current task is to breakdown Errors/Exceptions in chart group by error codes in error tables or list.

current query: My current query only returns null values.

index= (index name) host=(hostname)

| timechart count by error

Re: Breakdown Errors in Charts

ITWhisperer — Fri, 15 Apr 2022 16:51:00 GMT

It sounds like error is not a field that has been extracted from your events.

Can you share some sample events, assuming you need help extracting the error field?

Re: Breakdown Errors in Charts

Khanu89 — Fri, 15 Apr 2022 17:03:19 GMT

Here is a example from my dashboard.

Re: Breakdown Errors in Charts

ITWhisperer — Fri, 15 Apr 2022 18:07:04 GMT

What fields do you already have extracted?

You don't appear to have a field called error (note that field names are case sensitive).

Assuming that the fields that appear to be in your event, you could try

| stats count by ErrorCode

Re: Breakdown Errors in Charts

Khanu89 — Thu, 21 Apr 2022 22:03:36 GMT

@ITWhisperer I am running the following which breaks down different categories but how can I break down the Error type to percentage of errors such as 20% 404, 15% 503 etc..

index=epic_ehr
|stats count by Type

Re: How to breakdown errors in charts group by error codes in error tables or list?

Gr0und_Z3r0 — Fri, 22 Apr 2022 00:29:16 GMT

Hi @Khanu89

For your pie-chart, in the xml code add the following option configuration.

You should be able to see the percentage details against each category in the chart.
Something like below.

If it helps, Karma vote is appreciated