Dashboards & Visualizations

How to enhance column chart

a_vobard
Explorer

Hello,

I have created this search filter:

index=reg host=mp1 "export_successful" | TIMECHART count by "import_successful".

Out of this I have created a column chart for visualization - see below. A the moment it is visualized, if there is every day an successful export (every day there is just one), but I would like to see also, if the export was not successful. What is the easiest way to do it?

a_vobard_0-1627484708907.png

Thank you, ava

Labels (1)
0 Karma

ITWhisperer
Legend
index=reg host=mp1 "export_successful" | timechart count by "export_successful" | eval export_unsuccessful=if(isnull(count),1,null())
0 Karma

a_vobard
Explorer

Hello, what does this do exactly? I cannot interpret the "if" part. Thank you.

0 Karma

ITWhisperer
Legend

It is supposed to give you an unsuccessful count for when there isn't a  successful count, but this isn't going to work unless you fill in the time gaps, so try this

index=reg host=mp1 "export_successful" | timechart count by "export_successful" | makecontinuous _time | eval export_unsuccessful=if(isnull(count),1,null())
0 Karma

a_vobard
Explorer

Unfortunately this puts a 1 in every column of "export_unsuccessful".

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@a_vobard 

You can do it with same search. So can you please let us know  like "export_successful " events , how do you identify the export unsuccessful?

KV

0 Karma

a_vobard
Explorer

Hello, there is no event, if an export was not successful.  The only way it can be evaluated is, when the "successful" event is missing. So that seems tricky for me.

Ava

Tags (2)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

Then try creating dummy field unsuccessful_export when count is 0.

| eval unsuccessful_export=if(count==0,1,0)

 

You can put any count instead of 1 as per your requirement.

🙂 

 

0 Karma

a_vobard
Explorer

This unfortunately doesn't work. I have everywhere just zero's.

0 Karma

a_vobard
Explorer

What exactly is the one?

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!