Dashboards & Visualizations

How to write a search to display error rate over time in a dashboard?

Alpineer8
Explorer

My first query, so far so good.
index=blah host="blah" "Error" |stats count -- gives a count of events with "error"
index=blah host="blah" |stats count -- gives a count of all events

Now I want to divide errors by events and show error rate over time in a dashboard. (I just need the query instruction, I can do the dashboard).

Thank you.

HERE IS A RAW LOG:
Time Event
11/4/14
6:46:32.987 AM

2014-11-04 07:46:32,987] [DEBUG] [some.domain.com] Client [75.133.28.247] [] [/v1/video-sessions/16037354] AccountId [8245123330006080] [thread=http-8080-110] [sessionId=5cf90c773331c5b7c9ee8d66b71a25b2] [transId=ac189325-1415333792970-160] [user=somename@domain.net]::: Connection released: [id: 6018][route: {}->http://some.domain.com:8080][total kept alive: 3; route allocated: 4 of 200; total allocated: 4 of 300]
host = somehost source = /usr/share/tomcat6/logs/somelog.log sourcetype = somesource

1 Solution

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

View solution in original post

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

saikalyani9
New Member

Hi
I want to prepare a dashboard in splunk to show the applications and the error count and sort it based on the highest error count, may i know how can i do that?

0 Karma

Alpineer8
Explorer

index=blah host="blah" "Error" |timechart count

Thanks, works great.

Now I want to display errors as a % of total. I would like to add two columns. So far I have columns time, count. I want _time, error_count, total_count, error%.

Alpineer8
Explorer

Thanks! By the way, this isn't Nipin Doshi in Bangalore by any chance? I worked with Nipindra.

0 Karma

ndoshi
Splunk Employee
Splunk Employee

No, I am not Nipin Doshi.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...