Hi Splunkers,
Typically , I am looking for a SPL query to get the names of each client, total error associated with each client in it. I have used below query which returns the total number of events and total number of clients who are facing this issue. Could someone please help so that, I could further make Pie chart with it.
(index=prod-web) AND "Error looking for client=* invoicingEntityId='*'" | stats count as Total dc(cf_client) as Client
@KailA - Thank your help. But, I am just thinking if we can count the event the number of invents and not the number of cf_client?
Hello 🙂
You just to do a little modification in your search :
(index=prod-web) AND "Error looking for client=* invoicingEntityId='*'"
| stats count as Total BY cf_client
This should return the number of error by client.
Let me know if it helps you 🙂