Splunk Search

Create a chart with stacked success status and status>500

marco_carolo
Path Finder

Hello there.

 

I've a series of GET/POST request.

The request is to have inside the dashboard a stacked column graph that shows, per server, the values of successfull request below and above them the failed request (with status > 500)

 

What I'm doing is the following:

| chart count(eval(tonumber(status)>=500)) as internal_errors, count as total_requests by host | eval safe_requests=total_requests-internal_errors | table host, safe_requests, internal_errors

 Is there any better way to do that?

Second question:

In the result I'm having, I'm having the internal_errors displayed before the larger (hope that stays so) successfull count of total requests...

marco_carolo_0-1622123002926.png

You can see in the first 2 servers...

Any way to change this order?

Third question:

Is it possible to define 2 sets of color (eg Green and Red) for stacked values?

 

Edit: Thanks for any reply!

Labels (2)
0 Karma

marco_carolo
Path Finder

Solved the query part:

 

| chart count(eval(status>=500)) as internal_errors, count(eval(status<500)) as other_requests by host

 

What about the colors? Is there any way to define them?

 

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...