Splunk Search

How do i get top services and put it in chart??

RashmiGowda
Explorer

Hello,

I need to get the top 25 services from the requesting system and have to put it in a chart with the SUCCESS and FAILURE of transactions. So m using query like this. Can any one suggest how to use "TOP" Command with chart to get the top 25 services.

Query:

index="abc" requestingSystem="RS" | top limit=25 lookup_service_operation_name | transaction messageIdentifier maxspan=1m | search eventcount="2"| chart count as Transactions, count(eval(responseMessageField like"Success%" OR responseMessageField like"SUCCESS%")) as Success, count(eval(responseMessageField!="Success" AND responseMessageField!="SUCCESS")) as Failures by lookup_service_operation_name.

But this query is not helping to get the top 25 services and also count of the transactions for services also not correct.
Can any one plz help me out in this..?

Thanks in advance.

Tags (2)
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Without knowing your data this is just a guess...

index=abc requestingSystem=RS (start OR success OR failure)
| transaction messageIdentifier maxspan=1m startswith="start" endswith="success OR failure"
| eval success = if(match(responseMessageField, "(?i)success"), 1, 0)
| chart count as Transactions, sum(success) as Success by lookup_service_operation_name
| eval Failures = Transactions - Success
| sort - Transactions | head 25
0 Karma

RashmiGowda
Explorer

martin_mueller - thank you,

The data is in the xml format. it will contain the start time, end time and other user data with success and failure.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...