topic Re: How to count the status (ERROR or SUCCESS) for the list of clients accessing the application in Splunk Search

How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

AmitKrJash — Tue, 29 Sep 2020 08:09:21 GMT

Hi,
I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the application. The status will be either ERROR or SUCCESS. If the status is SUCCESS, then it is fine but if it is ERROR, it should count the number of ERROR for particular clients and should give the output in tabular format. For example lets say I have 2 clients: Amit@xyz.com and Jash@xyz.com
So the final output should be :
Client_ID Count of ERROR
Amit@xyz.com 25
Jash@xyz.com 54

I tried this query : index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*

So it showing the error status for all clients in the log file, but now my requirement is to get the tabular output like the example I mentioned above.

Re: How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

renjith_nair — Fri, 11 Dec 2015 10:25:38 GMT

Try

index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID

Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuide as well

Re: How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

AmitKrJash — Fri, 11 Dec 2015 11:21:45 GMT

Thanks a lot Renjith!! now I am able to get the required tabular output