topic Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name? in Splunk Search

How to edit my search to return a chart which counts failed and successful service executions and group by service name?

martingawantka — Mon, 27 Feb 2017 11:03:06 GMT

Hey Splunk community.

i want to create a search that returns a chart which counts the failed and successful service executions, group by service name.
As base i have several events of the following type:

{   [-] 
     hostname:   iawmsis03  
     logMessage:     KL_Kpos.priv.bma.clientManagement:sendToUmDestination(uuid=b0be3a9f-5adc-4339-8e86-ca0f148290a3:txid=d40ff865-2edb-4930-8808-8e6ef67b6aab:storeNumber=0112:action=reinstall:country=CZ) Service finished.  
     loggingTimestamp:   Mon Feb 27 11:56:01 CET 2017   
     packageName:    KL_Kpos    
     serviceName:    KL_Kpos.priv.bma.clientManagement:sendToUmDestination  
     severity:   INFO   
     uuid:   b0be3a9f-5adc-4339-8e86-ca0f148290a3   
}

I am able to extract only the failed services ( source="http:WebServiceCollector" logMessage="*Service failed*" ) and the finished services ( source="http:WebServiceCollector" logMessage="*Service finished*"). But i am not able to create a chart that shows the number of finished and failed services group by service name.

The search source="http:WebServiceCollector" | chart count(eval(logMessage="*Service finished*")) as finished, count(eval(logMessage="*Service failed*")) as failed by serviceName" always returns 0 for finished and failed.

Kind regards,
Martin

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

cmerriman — Mon, 27 Feb 2017 14:20:58 GMT

can you try:
EDITED

 source="http:WebServiceCollector" |eval finished=if(logMessage="Service finished",1,0)|eval failed=if(logMessage="Service failed",1,0)| chart sum(finished) as finished sum(failed) as failed by serviceName

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

somesoni2 — Mon, 27 Feb 2017 19:54:07 GMT

I believe you want to use sum(finished) and sum(failed) in the stats instead of count. (or update 0 with null() in if conditions).

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

cmerriman — Mon, 27 Feb 2017 20:13:54 GMT

Thanks @somesoni2, I copied over the original syntax and forgot to change the counts.

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

martingawantka — Tue, 28 Feb 2017 08:02:50 GMT

It is not working :-(.
I think the search has a problem with the two "*" in the search (Unfortunately both * are missing in my first post.

source="http:WebServiceCollector" |eval finished=if(logMessage="*Service failed*",1,0) | stats count(finished)
returns exactly the same value as
source="http:WebServiceCollector" |eval finished=if(logMessage="*Service finished*",1,0) | stats count(finished)

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

cmerriman — Fri, 21 Apr 2017 11:32:21 GMT

try this:

 source="http:WebServiceCollector" |eval finished=if(like(logMessage,"%Service finished%"),1,0)|eval failed=if(like(logMessage,"%Service failed%"),1,0)| chart sum(finished) as finished sum(failed) as failed by serviceName

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

DalJeanis — Fri, 21 Apr 2017 14:46:29 GMT

upvote because I prefer the "like" syntax over the = with asterisks.

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

DalJeanis — Fri, 21 Apr 2017 14:48:09 GMT

Edited post to make the *'s show up in the sample code. Basically, you need a space between an open parenthesis and the accent mark that marks the code sample. (`)

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

martingawantka — Fri, 28 Apr 2017 08:23:23 GMT

This works perectly fine for me. Thank you very much.

Re: How to edit my search to return a chart which counts failed and successful service executions and group by service name?

cmerriman — Wed, 31 May 2017 15:23:48 GMT

If this answers your question, could you please accept it to finalize the question? Thanks 🙂