Archive
Highlighted

How to stack all error codes per endpoints from a table?

New Member

Context:
Each or transactions has its unique RequestId, and in Splunk search, we will have multiple rows with the same RequestId to describe all the activities of a given transaction.

Goal:
stack all error codes per endpoints so we can have a chart with the x-axis is endpoints and the y-axis are a count of errorCodes per endpoint

Here is my solution which I feel very close but still cannot get what I want 😞 Looking for your advice on either my solution or any other solutions. Thanks

Search query:

index=xyz sourcetype=tomcat_epf_app
[search index=xyz sourcetype=tomcat_epf_app "ERROR ControllerAdvice" OR "ERROR Reporter" | fields + RequestId | fields - _* | rename RequestId as search | format "" "" "OR" "" "OR" "" ] 
| rex "ErrorCode\-(?<code>\d{3,3})\-" 
| eval endpoints=case(searchmatch("/login"),"/login", searchmatch("/subscription"),"/subscription",searchmatch("/email"),"/email")
| table endpoints, RequestId, code | where isnotnull(code) OR isnotnull(endpoints) | sort str(RequestId)

Result:

alt text

0 Karma
Highlighted

Re: How to stack all error codes per endpoints from a table?

Super Champion

If you could put sample data, we could have put exactly as you requested, but assuming from your SPL, please try below (i've changed your SPL to be better performing)

index=xyz sourcetype=tomcat_epf_app ("ERROR ControllerAdvice" OR "ERROR Reporter" ) 
 | rex "ErrorCode\-(?<code>\d{3,3})\-" 
 | eval endpoints=case(searchmatch("/login"),"/login", searchmatch("/subscription"),"/subscription",searchmatch("/email"),"/email")
 | stats count(endpoints)  by RequestId

you can do chart also instead of stats

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.