topic Re: how to generate error count report in Splunk Search

how to generate error count report

KShen — Mon, 06 Apr 2015 03:31:46 GMT

I have several query.Each query I have the list of the result.

But I just need to know the report of each of the total number displayed.

For example.

the query:
1. "Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0
2. "Not a valid request object from query" earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0

the report like:

error type total

Error sent back from database: 25
Not a valid request object from query: 38

any idea?

And another requirement is: dynamic earliest and latest date. all of query use the same earliest and latest date.

Re: how to generate error count report

stephanefotso — Mon, 06 Apr 2015 10:28:14 GMT

Hello! I know there is several ways to do that, but i will use Event Types to help you attain your objective. Here is the algorithm.

launch your first search and save it as an Event Type. For example, if your first search is the one bellow, you can give your Event Type the name error sent back from database

"Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0
1. launch the second search and do the same. Let suppose you saved it as not a valid reques object from query Event Type
2. Type this search: eventtype="error sent from database" OR eventtype="not a valid reques object from query"|stats count as Total by eventtype|rename eventtype AS "Error Type"

Re: how to generate error count report

KShen — Mon, 06 Apr 2015 14:21:13 GMT

Thanks a lot for the answer.
Is there a way to get the dynamic date range report.
In another words: Can I set the earliest and latest date, when I run the report?

Re: how to generate error count report

stephanefotso — Mon, 06 Apr 2015 16:11:30 GMT

yes of course! There is several ways to do it. One is that, you can include a timerange picker, and then remove your earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0 in your searchString, set the earliest and latest time of your timerange, and then set the earliest and latest time of your search query. Here is an example:

<form > 
  <label>compare a Table values </label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>-1d</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
  <table >
      <title >Table of Count Sourcetypes Between $time.earliest$ and $time.latest$ for index= $index$ </title>
      <searchString>index=$_internal | stats count as total_count  by sourcetype</searchString>
      <earliestTime>$time.earliest$</earliestTime>
      <latestTime>$time.latest$</latestTime>
      <option name="drilldown">none</option>
      <option name="field">count</option>
    </table>

  </row>
</form>