We have data like this:
TestPath 200 202 500 302
/test/v1 51 0 0 0
/test/v1/p1/test1/test 0 1 0 0
/test/v1/p1/test1/test1 0 0 8 0
/test/v1/p1/test1/test2 1 0 0 0
My search shows the data correctly and I see the visualization displays the chart properly, but when I convert that to a report and save it on the dashboard, it shows only 1 record which has data for 500 which is 8 records.
What might be the issue? Attached the images of how the data is shown on search/visualization chart and on the dashboard.
I tried on all kinds of browsers and its the same issue. Any help on what might be the issue would be appreciated.
Give this a try
index=logdatafile earliest=-3d | rex field=_raw "(?msi)(?\{.+\}$)" | spath input=json_field | table success.successcode,success.path,fault.errorcode,fault.path,fault.errorStatusCode | eval ResponseCode=coalesce('success.successcode', 'fault.errorcode' ,'fault.errorStatusCode') |where isnotnull(ResponseCode) | eval Path=coalesce('success.path','fault.path') | chart count by ResponseCode,Path
Give this a try
index=logdatafile earliest=-3d | rex field=_raw "(?msi)(?\{.+\}$)" | spath input=json_field | table success.successcode,success.path,fault.errorcode,fault.path,fault.errorStatusCode | eval ResponseCode=coalesce('success.successcode', 'fault.errorcode' ,'fault.errorStatusCode') |where isnotnull(ResponseCode) | eval Path=coalesce('success.path','fault.path') | chart count by ResponseCode,Path
This worked. Thank you for your inputs.
How do you specify the time frame of the search?
i am specifying the time frame as earliest=-3d, below is how my query looks..
index=logdatafile earliest=-3d | rex field=_raw "(?msi)(?\{.+\}$)" | spath input=json_field | table success.successcode,success.path,fault.errorcode,fault.path,fault.errorStatusCode | rename success.successcode as ResponseCode | rename fault.errorcode as ResponseCode|rename fault.errorStatusCode as ResponseCode| rename success.path as Path | rename fault.path as Path|where isnotnull(ResponseCode)| chart count by ResponseCode,Path