Splunk Search

Compare resp code count of two dates for each servername

indeed_2000
Motivator

Hi 

I have query that return count of different resp codes of servers for 2 days

now need to find different between these two days.

current output:

Respcodes    Srv1      Srv2       Srv3       Srv4  ….

200                    80           10          100       42

400                    12           55            11         0

500                     11           34             2          8

expected output:

Date.                  Respcodes    Srv1      Srv2       Srv3       Srv4  ….

2024/02/23  200                    80           10          100       42

2024/02/24  200                    70           19            11        11

2024/02/23  400                    12           55            11         0

2024/02/24  400                    44           14            46         89

2024/02/23   500                    11           34             2          8

2024/02/24   500                     11           34             2          9              

 

 

 

if there is delta that calculate count of each server for two dates will be great!

any idea?

thanks

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

You can only use three fields for xyseries, the x-axis, the y-axis and the series (names) - hence the name of the command! It is similar in that respect to the chart command. Try something like this

index="myindex" 
| rex field=source "\/.*\/log\.(?<servername>\w+)."
| rex "R(?<Respcode>\[\d+\]\[\d+\])" | bin _time span=1d

| stats count as Respcode_count by Respcode,servername,_time

| eval {servername} = Respcode_count
| fields - servername Respcode_count
| stats values(*) as * by _time Respcode
| fillnull value=0

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Your current output doesn't have any dates, so where are these going to come from?

Please provide some sample events?

Also, please provide your current search, so we can see how you are currently processing the events?

0 Karma

indeed_2000
Motivator

@ITWhisperer Here is the current query, and when i add _time in xyseries it will show resp ode as columns instead row::

index="myindex" 
| rex field=source "\/.*\/log\.(?<servername>\w+)."
| rex "R(?<Respcode>\[\d+\]\[\d+\])" | bin _time span=1d

| stats count as Respcode_count by Respcode,servername,_time

| xyseries Respcode ,servername,Respcode_count

 

Current output:

Respcodes    Srv1      Srv2       Srv3       Srv4  ….

200                    80           10          100       42

400                    12           55            11         0

500                     11           34             2          8

 

expected output:

Date.                  Respcodes    Srv1      Srv2       Srv3       Srv4  ….

2024/02/23  200                    80           10          100       42

2024/02/24  200                    70           19            11        11

2024/02/23  400                    12           55            11         0

2024/02/24  400                    44           14            46         89

2024/02/23   500                    11           34             2          8

2024/02/24   500                     11           34             2          9              


any idea?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

You can only use three fields for xyseries, the x-axis, the y-axis and the series (names) - hence the name of the command! It is similar in that respect to the chart command. Try something like this

index="myindex" 
| rex field=source "\/.*\/log\.(?<servername>\w+)."
| rex "R(?<Respcode>\[\d+\]\[\d+\])" | bin _time span=1d

| stats count as Respcode_count by Respcode,servername,_time

| eval {servername} = Respcode_count
| fields - servername Respcode_count
| stats values(*) as * by _time Respcode
| fillnull value=0

indeed_2000
Motivator

@ITWhisperer thanks work perfectly.

is there any way to show resp count numbers like this: 10,1K, 2M, …?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...