Dashboard creation on multiple events

[chris1]

Hi ,

I want to create the dashboard for the below event,

20 Aug 2015 11:56:36,271     :system.connector.dynamic.InvalidRemoteSessionException: com.system.kernel.CallObjectSystemException: Server problem. 

20 Aug 2015 09:51:07,562  System Exception occured while executing business function. Please try request again. :**SODetailLineStatusUpdateInterfac**(SO Detail Line Status Update from interface) 

I want the highlighted SODetailLineStatusUpdateInterfac (This may vary in next event, this is a function name) and in Y axis (InvalidRemoteSessionException) count of event.

Currently I am searching index=main *InvalidRemoteSessionException*, am getting only the first indexed data. Please suggest me how to create the dashboard on this case?

[anupjishnu]

Did you try using stats count?

[chris1]

Hi ,

I am new to splunk, I don't have much idea about that. Could you please help me?

[anupjishnu]

Stats Count reference = http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Stats

The following will return you the number of events in your search results.
index=main InvalidRemoteSessionException | stats count(_time)

[richgalloway]

@chris1, what problem are you trying to solve - getting a count of exceptions or getting both events in the same search?

[chris1]

Hi ,

I want count of event (exception) in Y axis and function name in X axis

[richgalloway]

You have two events more than two hours apart that appear to have nothing in common. How are they related?

[chris1]

Hi ,

I have edited my log for posting here..Please find the correct log below,

20 Aug 2015 11:56:36,271 :system.connector.dynamic.InvalidRemoteSessionException: com.system.kernel.CallObjectSystemException: Server problem.

20 Aug 2015 11:56:52,335 System Exception occured while executing business function. Please try request again. :SODetailLineStatusUpdateInterfac(SO Detail Line Status Update from interface)

It is happening in the next event itself..

[richgalloway]

Now the events are closer together in time, but there still appears to be nothing linking one to the other. Could they be considered to be parts of a transaction? If so, Splunk will need a common field to link them or some text that indicates the beginning and end of the transaction.

[chris1]

Hi ,

Yes it is part of single transaction, I have posted below the entire transaction from the log.

23 Aug 2015 20:51:15,334 [SEVERE] - [KERNEL] ERROR Associated kernel 28700 not found host G2F9APOF:8072(8075) SocID:50325, freeLocal com.jdedwards.system.net.JdeNetAssociatedKernelException: Kernel for associated message not exist
23 Aug 2015 20:51:15,335 [WARN ] - [RUNTIME] ERROR CallObject@1363dedc: COSE#1017 Associated kernel not found. Please see Enterprise Server log for details: host F1E9NPDA:6015(6019) SocID:50325 PID:28700 BSFN:CustomShipConfirmWrapper user:AIAINBND Env:JPD900
23 Aug 2015 20:51:15,335 [WARN ] - [RUNTIME] ERROR CallObject@1363dedc: Server problem. The server may still be available, but because of state information, the entire unit-of-work must be resubmitted user:AIAINBND Env:JPD900
23 Aug 2015 20:51:15,335 [SEVERE] - [INTEROP] Fail to execute BSFNMethod com.jdedwards.system.kernel.CallObjectSystemException: Server problem. The server may still be available, but because of state information, the entire unit-of-work must be resubmitted com.jdedwards.system.connector.dynamic.InvalidRemoteSessionException: Fail to execute BSFNMethod com.jdedwards.system.kernel.CallObjectSystemException: Server problem. The server may still be available, but because of state information, the entire unit-of-work must be resubmitted
23 Aug 2015 20:51:15,336 [SEVERE] - [BSSVFRAMEWORK] [Context ID: 10.10.120.39:2866011440550270322:81577] BSFNServiceException: System Exception occured while executing business function. Please try request again. :CustomShipConfirmWrapper(Custom Ship Confirm Call) oracle.e1.bssvfoundation.exception.BSFNServiceRuntimeException: System Exception occured while executing business function. Please try request again. :CustomShipConfirmWrapper(Custom Ship Confirm Call)

Highlighted InvalidRemoteSession event Count (Y axis) and CustomShipConfirmWrapper (This is the function name it may vary in the next event), it should be in X axis. For every function how many times this event occured, that is our idea to create this dashboard..