Splunk Search

Aliasing and Graphing events at search

craigwilkinson
Path Finder

Hi All,

Apologies if this is too simple question and has been asked 100 times, But i can't seem to find the answer I'm looking for..

For the time being, I simply want to graph the number transaction status over time from a sourcetype which shows the following: "SUCCESS" "FAILED", "BLOCKED"...

However, for failed transactions, the data is coming in with failed status= "FAIL" or "FAILURE".

How can I make "FAILED = FAIL + FAILURE", and plot the status = SUCCESS & status = BLOCKED along side it?

I'm currently using the search:
sourcetype= mydata | stats count by status

As per below:

Cheers,

Craigalt text

0 Karma
1 Solution

HiroshiSatoh
Champion

Try this!

sourcetype= mydata|eval status=if(status="FAIL" OR status="FAILER","FAILED",status) | stats count by status

View solution in original post

jplumsdaine22
Influencer

Since Hiroshi beat me to it with eval, for completeness here is how you can do it with foreach

sourcetype= mydata 
| stats count by status 
| foreach status [eval <<FIELD>> = if((<<FIELD>>=="FAIL" OR <<FIELD>>=="FAILURE"),"FAILED",<<FIELD>>) ] 
| stats sum(count) as count by status

See: http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Foreach

craigwilkinson
Path Finder

Thanks for the reply mate.

Interested to investigate this method a little further,

When I run your command, it doesn't seem to return any results :s

0 Karma

jplumsdaine22
Influencer

interesting - it definately should!

Here's a run anywhere example:

|gentimes start=-1
| eval status="FAIL"
| stats count by status
 | foreach status [eval <<FIELD>> = if((<<FIELD>>=="FAIL" OR <<FIELD>>=="FAILURE"),"FAILED",<<FIELD>>) ] 
 | stats sum(count) as count by status
0 Karma

HiroshiSatoh
Champion

Try this!

sourcetype= mydata|eval status=if(status="FAIL" OR status="FAILER","FAILED",status) | stats count by status

jplumsdaine22
Influencer

Beat me to it!

0 Karma

craigwilkinson
Path Finder

Awesome, thanks guys 🙂

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...