topic Re: Error with subsearch in Splunk Search

Error with subsearch

DonDandrea — Mon, 28 Sep 2020 16:26:10 GMT

I am new to creating subsearches and have completed a few of them successfully. This latest example is causing me a bit of greif.

I am trying to
1. do a stats count to provide error count in one search
2. sum a value to create a transaction count from a different data source
3. display the results in a table or chart like below

transactions 10000
errors 100

Here is my search
index=dspro sourcetype=telemetry | chart sum(TotalTransactions) as transaction_count [search index=dspro sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph) | stats count as error_count] | chart, transaction_count, error_count

Here is the error it generates
Error in 'chart' command: The argument '( ( error_count=25045 ) )' is invalid.

Eventually I will want to create a third line in the chart that provides the percentage of errors.

Please help

Thank you
Don

Re: Error with subsearch

somesoni2 — Tue, 22 Apr 2014 17:33:30 GMT

Try this

index=dspro (sourcetype=telemetry) OR (sourcetype=bootlogmaster (DSproSystem=Prod OR DSproSystem=Beta OR DSproSystem=Alph)) | stats sum(TotalTransactions) as transaction_count count(eval(sourcetype="bootlogmaster")) as error_count

Re: Error with subsearch

martin_mueller — Tue, 22 Apr 2014 17:46:18 GMT

I think you should replace count(eval(sourcetype="telemetry")) with sum(TotalTransactions).

Re: Error with subsearch

DonDandrea — Tue, 22 Apr 2014 17:49:06 GMT

That definately is a step closer. The only problem is that is doing a stats count to determine a value for transaction count. Transaction count needs to be determined by adding together all the values for the field TotalTransactions from the telemetry data.

Re: Error with subsearch

somesoni2 — Tue, 22 Apr 2014 17:49:36 GMT

Nice catch 🙂 , updated answer to correct this.

Re: Error with subsearch

DonDandrea — Wed, 23 Apr 2014 11:12:36 GMT

Now we're talking. Thank you very much. You guys are awesome.