topic Re: Need help with getting count of successful events after failure in Splunk Search

How to get count of successful events after failure?

Pjyoti — Thu, 09 Feb 2023 18:57:54 GMT

Hi,

I have a use case where in i want to find out how many download api failed for a given document and how many out of the failed were successful after subsequent call

I have no clue how to search this on splunk

right now I am finding the failed ones using the below query

index=ty_ss “download/docIds?=“ “500” | Rex “docId=(?<docId>.*)” | eval event_time = strftime() | table docIds, event_time

Re: Need help with getting count of successful events after failure

scelikok — Thu, 09 Feb 2023 17:08:26 GMT

Hi @Pjyoti,

You can use streamstats to count successful downloads by resetting on fail.

https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Streamstats#The_reset_on_change_argument

Please try below sample;

index=ty_ss | streamstats count as success_count by http_response reset_after=(http_response=500)

Re: Need help with getting count of successful events after failure

Pjyoti — Fri, 10 Feb 2023 17:03:25 GMT

I think my question was not clear so the requirement here is that I need to find the below things :

1. How many documents failed with 500 error which is straightforward

2. how many documents failed first time for all users and after how many retries were they successful (if they were) or were they not retried at all ?

I am stuck at the second case

i am not understanding how do I group the document and show a retry number if it wasn’t retried at all then it should give 0 if the retries didn’t work they should give some other result and if the retries were successful after how many attempts were they successful.

Re: Need help with getting count of successful events after failure

Pjyoti — Fri, 10 Feb 2023 17:04:48 GMT

By successful I mean the api returned 200 for that doc for that user

Re: How to get count of successful events after failure?

scelikok — Sat, 11 Feb 2023 09:20:24 GMT

Hi @Pjyoti,

Can you please share a few log lines? Because it seems user and API return values should be extracted before analysis.

Re: How to get count of successful events after failure?

Pjyoti — Sat, 11 Feb 2023 16:12:11 GMT

sample logs attached

Re: How to get count of successful events after failure?

Pjyoti — Sat, 18 Feb 2023 15:58:54 GMT

Hi any update ??

Can someone help