How do i get top services and put it in chart??

[RashmiGowda]

Hello,

I need to get the top 25 services from the requesting system and have to put it in a chart with the SUCCESS and FAILURE of transactions. So m using query like this. Can any one suggest how to use "TOP" Command with chart to get the top 25 services.

Query:

index="abc" requestingSystem="RS" | top limit=25 lookup_service_operation_name | transaction messageIdentifier maxspan=1m | search eventcount="2"| chart count as Transactions, count(eval(responseMessageField like"Success%" OR responseMessageField like"SUCCESS%")) as Success, count(eval(responseMessageField!="Success" AND responseMessageField!="SUCCESS")) as Failures by lookup_service_operation_name.

But this query is not helping to get the top 25 services and also count of the transactions for services also not correct.
Can any one plz help me out in this..?

Thanks in advance.

[martin_mueller]

Without knowing your data this is just a guess...

index=abc requestingSystem=RS (start OR success OR failure)
| transaction messageIdentifier maxspan=1m startswith="start" endswith="success OR failure"
| eval success = if(match(responseMessageField, "(?i)success"), 1, 0)
| chart count as Transactions, sum(success) as Success by lookup_service_operation_name
| eval Failures = Transactions - Success
| sort - Transactions | head 25

[RashmiGowda]

martin_mueller - thank you,

The data is in the xml format. it will contain the start time, end time and other user data with success and failure.