Hi,
I am getting below events from my splunk search but how to show them in pie chart.
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error Invalid request".\"}]","podName":"test-service","category":"ERROR"}
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error downsteam error".\"}]","podName":"test-service","category":"ERROR"}
basically I want to show the String which is there inside Error is array (basically the message part) in the pie chart for today's date
| makeresults
| eval _raw="raw
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error Invalid request\".\"}]\",\"podName\":\"test-service\",\"category\":\"ERROR\"}
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error downsteam error\".\"}]\",\"podName\":\"test-service\",\"category\":\"ERROR\"}"
| multikv forceheader=1
| rex "\[(?<codes>.*)\]"
| spath input=codes
| stats count by message
Viz >> Pie Chart
| makeresults
| eval _raw="raw
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error Invalid request\".\"}]\",\"podName\":\"test-service\",\"category\":\"ERROR\"}
Correlation Id :\"e7b4b14\", msg : Error is:[{\"code\":688,\"message\":\"api failed with error downsteam error\".\"}]\",\"podName\":\"test-service\",\"category\":\"ERROR\"}"
| multikv forceheader=1
| rex "\[(?<codes>.*)\]"
| spath input=codes
| stats count by message
Viz >> Pie Chart
Thank you @to4kawa ,
Can we group 1 type of error and it's count in 1 slice and other type and it's count in 2nd slice in pie chart?
yes, you can.
how can i do that?
Thanks, I could do that with | stats count by codes, Thank you so much @to4kawa
use eval
to collect other types