Splunk Search

How to Fill Null for fail or exception

indeed_2000
Builder

Hi

here is my spl, that show different status:

index="myindex" | rex "status\[(?<status>\w+)"| stats count(status) by status

here is the current result:

status                       count(status)
successful             3581

 

here is the exception result:

status                       count(status)
successful             3581

fail                                0

exception                0

 

FYI: some time fail or exception might bot be in log file some time might be exist, neet to show in stats result even if these stats not exist.

Any idea?

Thanks

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| append [
  | makeresults
  | fields - _time
  | eval status=split("exception|fail","|")
  | mvexpand status
  | eval "count(status)" = 0]
| stats sum(*) as * by status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

| append [
  | makeresults
  | fields - _time
  | eval status=split("exception|fail","|")
  | mvexpand status
  | eval "count(status)" = 0]
| stats sum(*) as * by status

indeed_2000
Builder

Thanks it work, How can I add total column, like below?

 

status                       count(status)
successful             3581

fail                                0

exception                0

total                              3581

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
0 Karma

indeed_2000
Builder

before ask here use addtotals but status field is empty and try label but create another column.

 

current output:

status                count(status)
Exception        0
Fail                       0
successful     3581
                              3581

expected output:

status                count(status)
Exception        0
Fail                       0
successful     3581
total                    3581

 

0 Karma