Splunk Search

How can i create a stacked bar graph showing the different log levels?

sphiwee
Contributor

How can i create a stacked bar graph showing the different log levels (Error, Info, Debug)  generated by  each  Process 


index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""

Labels (3)
0 Karma
1 Solution

richgalloway
SplunkTrust
SplunkTrust

Try using the chart command to get both Log_level and Process in the output.

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""
| chart count over Process by Log_level

 To see the chart, switch to the Visualization tab, choose the "Column Chart" visualization, then select "Stacked" from the Format dropdown.  See the example below.

richgalloway_0-1692373794408.png

 

---
If this reply helps you, Karma would be appreciated.

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

Charts require a command that produces statistics (chart, stats, timechart, etc.).  Try this

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""
| stats count by Log_level

Then switch to the Visualization tab, choose the Bar Chart visualization, then select the Stacked format.

---
If this reply helps you, Karma would be appreciated.

sphiwee
Contributor

I have applied it but but its only showin like this, I want the log level to be stacked and to show according to Process 

sphiwee_0-1692363740674.png

 

Tags (1)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try using the chart command to get both Log_level and Process in the output.

index="intau_workfusion" sourcetype=workfusion.out.log host=*
| rex "^(?<Date>\d+-\d+-\d+\s+\d+:\d+:\d+)\s+\[[^\]]*\]\s*\[(?<Process>[^\]]*)\]\s*\[(?<Step>[^\]]*)\]\s*\[(?<User>[^\]]*)\]\s*[^\[]+\s\[(?<Log_level>[^\]]+)"
| search Log_level="*"
| where Process != ""
| chart count over Process by Log_level

 To see the chart, switch to the Visualization tab, choose the "Column Chart" visualization, then select "Stacked" from the Format dropdown.  See the example below.

richgalloway_0-1692373794408.png

 

---
If this reply helps you, Karma would be appreciated.
Get Updates on the Splunk Community!

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...