Splunk Search

How can i create a stacked bar graph showing the different log levels?

sphiwee
Contributor

How can i create a stacked bar graph showing the different log levels (Error, Info, Debug)  generated by  each  Process 


index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the chart command to get both Log_level and Process in the output.

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""
| chart count over Process by Log_level

 To see the chart, switch to the Visualization tab, choose the "Column Chart" visualization, then select "Stacked" from the Format dropdown.  See the example below.

richgalloway_0-1692373794408.png

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Charts require a command that produces statistics (chart, stats, timechart, etc.).  Try this

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""
| stats count by Log_level

Then switch to the Visualization tab, choose the Bar Chart visualization, then select the Stacked format.

---
If this reply helps you, Karma would be appreciated.

sphiwee
Contributor

I have applied it but but its only showin like this, I want the log level to be stacked and to show according to Process 

sphiwee_0-1692363740674.png

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the chart command to get both Log_level and Process in the output.

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""
| chart count over Process by Log_level

 To see the chart, switch to the Visualization tab, choose the "Column Chart" visualization, then select "Stacked" from the Format dropdown.  See the example below.

richgalloway_0-1692373794408.png

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Monitoring MariaDB and MySQL

In a previous post, we explored monitoring PostgreSQL and general best practices around which metrics to ...

Financial Services Industry Use Cases, ITSI Best Practices, and More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Splunk Federated Analytics for Amazon Security Lake

Thursday, November 21, 2024  |  11AM PT / 2PM ET Register Now Join our session to see the technical ...