Dashboards & Visualizations

How to write a search to display error rate over time in a dashboard?

Alpineer8
Explorer

My first query, so far so good.
index=blah host="blah" "Error" |stats count -- gives a count of events with "error"
index=blah host="blah" |stats count -- gives a count of all events

Now I want to divide errors by events and show error rate over time in a dashboard. (I just need the query instruction, I can do the dashboard).

Thank you.

HERE IS A RAW LOG:
Time Event
11/4/14
6:46:32.987 AM

2014-11-04 07:46:32,987] [DEBUG] [some.domain.com] Client [75.133.28.247] [] [/v1/video-sessions/16037354] AccountId [8245123330006080] [thread=http-8080-110] [sessionId=5cf90c773331c5b7c9ee8d66b71a25b2] [transId=ac189325-1415333792970-160] [user=somename@domain.net]::: Connection released: [id: 6018][route: {}->http://some.domain.com:8080][total kept alive: 3; route allocated: 4 of 200; total allocated: 4 of 300]
host = somehost source = /usr/share/tomcat6/logs/somelog.log sourcetype = somesource

1 Solution

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

View solution in original post

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

saikalyani9
New Member

Hi
I want to prepare a dashboard in splunk to show the applications and the error count and sort it based on the highest error count, may i know how can i do that?

0 Karma

Alpineer8
Explorer

index=blah host="blah" "Error" |timechart count

Thanks, works great.

Now I want to display errors as a % of total. I would like to add two columns. So far I have columns time, count. I want _time, error_count, total_count, error%.

Alpineer8
Explorer

Thanks! By the way, this isn't Nipin Doshi in Bangalore by any chance? I worked with Nipindra.

0 Karma

ndoshi
Splunk Employee
Splunk Employee

No, I am not Nipin Doshi.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...