Dashboards & Visualizations

How to write a search to display error rate over time in a dashboard?

Alpineer8
Explorer

My first query, so far so good.
index=blah host="blah" "Error" |stats count -- gives a count of events with "error"
index=blah host="blah" |stats count -- gives a count of all events

Now I want to divide errors by events and show error rate over time in a dashboard. (I just need the query instruction, I can do the dashboard).

Thank you.

HERE IS A RAW LOG:
Time Event
11/4/14
6:46:32.987 AM

2014-11-04 07:46:32,987] [DEBUG] [some.domain.com] Client [75.133.28.247] [] [/v1/video-sessions/16037354] AccountId [8245123330006080] [thread=http-8080-110] [sessionId=5cf90c773331c5b7c9ee8d66b71a25b2] [transId=ac189325-1415333792970-160] [user=somename@domain.net]::: Connection released: [id: 6018][route: {}->http://some.domain.com:8080][total kept alive: 3; route allocated: 4 of 200; total allocated: 4 of 300]
host = somehost source = /usr/share/tomcat6/logs/somelog.log sourcetype = somesource

1 Solution

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

View solution in original post

ndoshi
Splunk Employee
Splunk Employee

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

saikalyani9
New Member

Hi
I want to prepare a dashboard in splunk to show the applications and the error count and sort it based on the highest error count, may i know how can i do that?

0 Karma

Alpineer8
Explorer

index=blah host="blah" "Error" |timechart count

Thanks, works great.

Now I want to display errors as a % of total. I would like to add two columns. So far I have columns time, count. I want _time, error_count, total_count, error%.

Alpineer8
Explorer

Thanks! By the way, this isn't Nipin Doshi in Bangalore by any chance? I worked with Nipindra.

0 Karma

ndoshi
Splunk Employee
Splunk Employee

No, I am not Nipin Doshi.

0 Karma
Get Updates on the Splunk Community!

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...