Can you share some search commands related to application monitoring?

[asm_coe]

Hi,

I have a few access logs.

Please share a few search commands related to application monitoring that will create dashboards.
Target will be to create meaningful charts that show application availability and other related stuff.

Thanks

[martinpu]

index=yourindex sourcetype=access* 
| timechart bins=500 count by status

basic overview of statuses, replace bins=500 with span=1m to see stats by one minute buckets. status might be named http_response_code or something similiar

Might want to disregard HEAD or some other method that is not of interest to you, then you should add method!=head (or whatever your field name is there)

index=yourindex sourcetype=access* 
|chart count over uri by status 
|addtotals
|eval successrate=round(floor(coalesce('200',0)/Total*10000)/100,2)

returns all URI by successrate. You uri might be defined as uri_path field or something similiar.
Replace count over uri with count over source/host or to see source specific data as an e.g.

[kamlesh_vaghela]

@asm_coe

You can find some useful search command here: https://docs.splunk.com/Documentation/Splunk/7.2.5/SearchReference/CommonStatsFunctions

[asm_coe]

Thanks for the response.

[kamlesh_vaghela]

@asm_coe

Please share your event details So I can help you with search design also.

[asm_coe]

Please see as follows Application availability, Response time, HTTP error rate and any other events that can be monitored in application. Kindly let me know if any other info is required.