extracting and creating dashboards

[mammefen]

how to combine the following fileds and create a statical value of succesfull and failed call of the particular api by client id?

sample splunk log event:

1.INFO 2019-07-16 16:39:34,938 AFTER: IP_address=/xxxxxxxxx API_name=AAAAAAAAA server ip=RRRRRRR trace_ID=d24eea70-a809-11e9-9eb4-005056906aa7 location=en_US {http.reason=Bad Request, http.status=400, Content-Type=application/json;charset=UTF-8}

2.INFO 2019-07-16 16:39:34,809 client_ID: KKKKKK API_name: AAAAAAAA

just i want to create a dashboard that will show the number of successfull and failed using the client_ID?

thanks,

[DavidHourani]

Hi @mammefen,

Try something like this :

Index=yourIndex | stats last(status) as status last(clientID) as clientID by API_name

Let me know if that works out for you.

Cheers,
David

[mammefen]

hi david,

thank you for your help
it worked in some extent but there are some null values of the client id for the corresponding status. I am thinking to join the events first and then do the stats. so, can you help on joining the two events?

Thanks,

mammefen

[DavidHourani]

Most welcome ! The search above does a join since it runs stats on a common field for both events.

Its faster than running a join command but if you would rather use that then it should look as follows :

Index=yourIndex event=firstEvent | join clientID [Index=yourIndex event=firstEvent]

You can find more info about the join command here :
https://docs.splunk.com/Documentation/Splunk/7.3.0/SearchReference/Join

[mammefen]

hi david,
i appreciate your help. the following is the sample table i got by using your method.
status---client_id
1. 200----kkkk----API_name
2. 400----empty
3. empty------kkk
4. 403--------kkk
5. emptyk---empty
i am getting this kind of table by using your query . i do not want to get the empty related with the value . how can i exclude from the table? btw all the api names are listed correctly.

than you

[niketn]

@mammefen what is the correlation between events 1 and 2? How does client_ID in 2nd event correlate to event 1?

[mammefen]

the API name is the same for event1 AND 2 .

[niketn]

But API name will be same for multiple clients as well.