topic Re: interface wise success and error bar chart on a single dashboard in Splunk Search

How to represent interface wise success and error bar chart on a single dashboard?

avikc100 — Mon, 12 Dec 2022 16:21:17 GMT

I want to represent interface wise (DFOINTERFACE) success and failure

success log below, where completed successfully is main keyword:
2022-12-06 14:43:21:064 EST| INFO |dfo_.allocation DFOINTERFACE=dfo_.allocation START -- dfo_.allocation Execution accountNumber=%productValidationRequest/accountNumber/accountBase%%productValidationRequest/accountNumber/accountDest% completed successfully MFRESPONSETIME=96 millisec 176 microsec 997 nanosec MFPROGRAMEID=OMCRCAL1 Service Name : LowCodePlatform.RESTService.allocation:_post

and error log below, where completed with Error is main keyword:

2022-12-06 13:52:38:233 EST| ERROR |dfo_.productValidation DFOINTERFACE=dfo_.productValidation START -- dfo_.productValidation Execution accountNumber=076732008 completed with Error 20120014 - CICS ECI Connection: Transformation error on reply: Invalid decimal digit: MFRESPONSETIME=411 millisec 753 microsec 627 nanosec MFPROGRAMEID=OECDFB21 Service Name : LowCodePlatform.RESTService.ProductValidation

I want a report like, please see the attachment

Re: interface wise success and error bar chart on a single dashboard

richgalloway — Sun, 11 Dec 2022 17:54:13 GMT

What have you tried so far? How did those attempts not meet your needs?

Re: interface wise success and error bar chart on a single dashboard

avikc100 — Sun, 11 Dec 2022 19:08:46 GMT

I have tried separately.
Please see the attachment

for success log interface wise

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed successfully |stats count by DFOINTERFACE

and for failure log interface wise

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed with error |stats count by DFOINTERFACE

I am unable to combine both together.

Re: interface wise success and error bar chart on a single dashboard

richgalloway — Sun, 11 Dec 2022 21:15:39 GMT

You are able to, you just don't know how to. 😀

Here's one way.

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" ("completed successfully" OR "completed with error") ```Check the status of each event``` | eval status = if(searchmatch("completed successfully"), "success", "error") ```Count the results and group them by interface and status``` | stats count by DFOINTERFACE,status ```Rearrange the results``` | xyseries DFOINTERFACE status count

Re: interface wise success and error bar chart on a single dashboard

avikc100 — Mon, 12 Dec 2022 03:12:22 GMT

your solution was perfect. It solved my problem

Re: interface wise success and error bar chart on a single dashboard

richgalloway — Mon, 12 Dec 2022 13:26:44 GMT

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.