Splunk Search

Combining two search and charting successfull event and errors in one chart.

kermit_maness
Engager

Hello everyone,

Seeking your help. I have  logs where Transaction_ID is unique to  transaction. Depending on each transaction there can be multiple action. But if there is an error there would be a log generated with Action=Error.

I have created two search 

One for successfull creation of transaction:

`base_search` | search action=Error | timechart distinct_count(Transaction_ID) as Successfull

And for errors.

`base_search` | search action!=Error | timechart distinct_count(Transaction_ID) as Error.

I would like to simply display these two in one chart to see number of successfull events vs failed. What would be the best method to combine these two ?

 

Appreciate any guidance.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what time value you want to chart so I have assumed the last time for the transaction, I have also assumed you want daily counts. Gather the actions per transaction, and set status based on whether "error" is one of the status for the transaction.

| stats values(actions) as actions last(_time) as _time by transactionid
| eval status=if(match(actions,"error"),"Error","Successful")
| timechart span=1d dc(transactionid) by status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what time value you want to chart so I have assumed the last time for the transaction, I have also assumed you want daily counts. Gather the actions per transaction, and set status based on whether "error" is one of the status for the transaction.

| stats values(actions) as actions last(_time) as _time by transactionid
| eval status=if(match(actions,"error"),"Error","Successful")
| timechart span=1d dc(transactionid) by status
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...