Splunk Search

Create a chart with stacked success status and status>500

marco_carolo
Path Finder

Hello there.

 

I've a series of GET/POST request.

The request is to have inside the dashboard a stacked column graph that shows, per server, the values of successfull request below and above them the failed request (with status > 500)

 

What I'm doing is the following:

| chart count(eval(tonumber(status)>=500)) as internal_errors, count as total_requests by host | eval safe_requests=total_requests-internal_errors | table host, safe_requests, internal_errors

 Is there any better way to do that?

Second question:

In the result I'm having, I'm having the internal_errors displayed before the larger (hope that stays so) successfull count of total requests...

marco_carolo_0-1622123002926.png

You can see in the first 2 servers...

Any way to change this order?

Third question:

Is it possible to define 2 sets of color (eg Green and Red) for stacked values?

 

Edit: Thanks for any reply!

Labels (2)
0 Karma

marco_carolo
Path Finder

Solved the query part:

 

| chart count(eval(status>=500)) as internal_errors, count(eval(status<500)) as other_requests by host

 

What about the colors? Is there any way to define them?

 

0 Karma
Get Updates on the Splunk Community!

Insights from .conf 2025, Smart Edge Processor Scaling, and a New Splunk Lantern ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Machine Learning - Assisted Adaptive Thresholding

Let’s talk thresholding. Have you set up static thresholds? Tired of static thresholds triggering false ...

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...