Dashboards & Visualizations
Highlighted

Dashboard creation on multiple events

Explorer

Hi ,

I want to create the dashboard for the below event,

20 Aug 2015 11:56:36,271     :system.connector.dynamic.InvalidRemoteSessionException: com.system.kernel.CallObjectSystemException: Server problem. 

20 Aug 2015 09:51:07,562  System Exception occured while executing business function. Please try request again. :**SODetailLineStatusUpdateInterfac**(SO Detail Line Status Update from interface) 

I want the highlighted SODetailLineStatusUpdateInterfac (This may vary in next event, this is a function name) and in Y axis (InvalidRemoteSessionException) count of event.

Currently I am searching index=main *InvalidRemoteSessionException*, am getting only the first indexed data. Please suggest me how to create the dashboard on this case?

Tags (2)
0 Karma
Highlighted

Re: Dashboard creation on multiple events

SplunkTrust
SplunkTrust

You have two events more than two hours apart that appear to have nothing in common. How are they related?

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Dashboard creation on multiple events

Explorer

Hi ,

I have edited my log for posting here..Please find the correct log below,

20 Aug 2015 11:56:36,271 :system.connector.dynamic.InvalidRemoteSessionException: com.system.kernel.CallObjectSystemException: Server problem.

20 Aug 2015 11:56:52,335 System Exception occured while executing business function. Please try request again. :SODetailLineStatusUpdateInterfac(SO Detail Line Status Update from interface)

It is happening in the next event itself..

0 Karma
Highlighted

Re: Dashboard creation on multiple events

SplunkTrust
SplunkTrust

Now the events are closer together in time, but there still appears to be nothing linking one to the other. Could they be considered to be parts of a transaction? If so, Splunk will need a common field to link them or some text that indicates the beginning and end of the transaction.

---
If this reply helps you, an upvote would be appreciated.
Highlighted

Re: Dashboard creation on multiple events

Explorer

Hi ,

Yes it is part of single transaction, I have posted below the entire transaction from the log.

23 Aug 2015 20:51:15,334 [SEVERE] - [KERNEL] ERROR Associated kernel 28700 not found host G2F9APOF:8072(8075) SocID:50325, freeLocal com.jdedwards.system.net.JdeNetAssociatedKernelException: Kernel for associated message not exist
23 Aug 2015 20:51:15,335 [WARN ] - [RUNTIME] ERROR CallObject@1363dedc: COSE#1017 Associated kernel not found. Please see Enterprise Server log for details: host F1E9NPDA:6015(6019) SocID:50325 PID:28700 BSFN:CustomShipConfirmWrapper user:AIAINBND Env:JPD900
23 Aug 2015 20:51:15,335 [WARN ] - [RUNTIME] ERROR CallObject@1363dedc: Server problem. The server may still be available, but because of state information, the entire unit-of-work must be resubmitted user:AIAINBND Env:JPD900
23 Aug 2015 20:51:15,335 [SEVERE] - [INTEROP] Fail to execute BSFNMethod com.jdedwards.system.kernel.CallObjectSystemException: Server problem. The server may still be available, but because of state information, the entire unit-of-work must be resubmitted com.jdedwards.system.connector.dynamic.InvalidRemoteSessionException: Fail to execute BSFNMethod com.jdedwards.system.kernel.CallObjectSystemException: Server problem. The server may still be available, but because of state information, the entire unit-of-work must be resubmitted
23 Aug 2015 20:51:15,336 [SEVERE] - [BSSVFRAMEWORK] [Context ID: 10.10.120.39:2866011440550270322:81577] BSFNServiceException: System Exception occured while executing business function. Please try request again. :CustomShipConfirmWrapper(Custom Ship Confirm Call) oracle.e1.bssvfoundation.exception.BSFNServiceRuntimeException: System Exception occured while executing business function. Please try request again. :CustomShipConfirmWrapper(Custom Ship Confirm Call)

Highlighted InvalidRemoteSession event Count (Y axis) and CustomShipConfirmWrapper (This is the function name it may vary in the next event), it should be in X axis. For every function how many times this event occured, that is our idea to create this dashboard..

0 Karma
Highlighted

Re: Dashboard creation on multiple events

Path Finder

Did you try using stats count?

0 Karma
Highlighted

Re: Dashboard creation on multiple events

Explorer

Hi ,

I am new to splunk, I don't have much idea about that. Could you please help me?

0 Karma
Highlighted

Re: Dashboard creation on multiple events

Path Finder

Stats Count reference = http://docs.splunk.com/Documentation/Splunk/6.1.3/SearchReference/Stats

The following will return you the number of events in your search results.
index=main InvalidRemoteSessionException | stats count(_time)

0 Karma
Highlighted

Re: Dashboard creation on multiple events

SplunkTrust
SplunkTrust

@chris1, what problem are you trying to solve - getting a count of exceptions or getting both events in the same search?

---
If this reply helps you, an upvote would be appreciated.
0 Karma
Highlighted

Re: Dashboard creation on multiple events

Explorer

Hi ,

I want count of event (exception) in Y axis and function name in X axis

0 Karma