Dashboards & Visualizations

How to write a search to display error rate over time in a dashboard?

Alpineer8
Explorer

My first query, so far so good.
index=blah host="blah" "Error" |stats count -- gives a count of events with "error"
index=blah host="blah" |stats count -- gives a count of all events

Now I want to divide errors by events and show error rate over time in a dashboard. (I just need the query instruction, I can do the dashboard).

Thank you.

HERE IS A RAW LOG:
Time Event
11/4/14
6:46:32.987 AM

2014-11-04 07:46:32,987] [DEBUG] [some.domain.com] Client [75.133.28.247] [] [/v1/video-sessions/16037354] AccountId [8245123330006080] [thread=http-8080-110] [sessionId=5cf90c773331c5b7c9ee8d66b71a25b2] [transId=ac189325-1415333792970-160] [user=somename@domain.net]::: Connection released: [id: 6018][route: {}->http://some.domain.com:8080][total kept alive: 3; route allocated: 4 of 200; total allocated: 4 of 300]
host = somehost source = /usr/share/tomcat6/logs/somelog.log sourcetype = somesource

1 Solution

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

View solution in original post

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

saikalyani9
New Member

Hi
I want to prepare a dashboard in splunk to show the applications and the error count and sort it based on the highest error count, may i know how can i do that?

0 Karma

Alpineer8
Explorer

index=blah host="blah" "Error" |timechart count

Thanks, works great.

Now I want to display errors as a % of total. I would like to add two columns. So far I have columns time, count. I want _time, error_count, total_count, error%.

Alpineer8
Explorer

Thanks! By the way, this isn't Nipin Doshi in Bangalore by any chance? I worked with Nipindra.

0 Karma

ndoshi
Splunk Employee
Splunk Employee

No, I am not Nipin Doshi.

0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...