topic Re: Custom Search in Splunk Search

Custom Search

Ash1 — Sun, 18 Feb 2024 19:59:02 GMT

query:

|tstats count where index=new_index host=new-host source=https://itcsr.welcome.com/logs* by PREFIX(status:) _time
|rename status: as Total_Status
|where isnotnull(Total_Status)
|eval SuccessCount=if(Total_Status="0", count, Success), FailedCount=if(Total_Status!="0", count, Failed)

OUTPUT:

Total_Status	_time	count	FailedCount	SuccessCount
0	2022-01-12 13:30	100		100
0	2022-01-12 13:00	200		200
0	2022-01-13 11:30	110		110
500	2022-01-13 11:00	2	2
500	2022-01-11 10:30	4	4
500	2022-01-11 10:00	8	8

But i want the output as shown below table:

_time	SuccessCount	FailedCount
2022-01-13	110	2
2022-01-12	300	0
2022-01-11	0	12

Re: Custom Search

ITWhisperer — Sun, 18 Feb 2024 20:08:45 GMT

| bin _time span=1d | stats sum(SuccessCount) as SuccessCount sum(FailedCount) as FailedCount by _time

Re: Custom Search

Ash1 — Mon, 19 Feb 2024 18:20:58 GMT

Hi @ITWhisperer ,

Thank you it worked, but when there are no counts it's showing as empty values in table.

I used fillnull value=0, but it's not working.

How to do this???

Re: Custom Search

ITWhisperer — Tue, 20 Feb 2024 09:13:50 GMT

Try something like this

| timechart span=1d sum(SuccessCount) as SuccessCount sum(FailedCount) as FailedCount

Re: Custom Search

Ash1 — Sun, 25 Feb 2024 18:53:06 GMT

Thank you @ITWhisperer