Splunk Search

How to breakdown errors in charts group by error codes in error tables or list?

Khanu89
Explorer

Hello - I am a new Splunk user and learning as I go. My current task is to breakdown Errors/Exceptions in chart group by error codes in error tables or list.

current query: My current query  only returns null values.

index= (index name) host=(hostname)

| timechart count by error

Labels (4)
Tags (4)
0 Karma
1 Solution

Gr0und_Z3r0
Communicator

Hi @Khanu89 

For your pie-chart, in the xml code add the following option configuration.

<option name="charting.chart.showPercent">1</option>


You should be able to see the percentage details against each category in the chart.
Something like below.

Gr0und_Z3r0_0-1650587337249.png

If it helps, Karma vote is appreciated

 

View solution in original post

Gr0und_Z3r0
Communicator

Hi @Khanu89 

For your pie-chart, in the xml code add the following option configuration.

<option name="charting.chart.showPercent">1</option>


You should be able to see the percentage details against each category in the chart.
Something like below.

Gr0und_Z3r0_0-1650587337249.png

If it helps, Karma vote is appreciated

 

ITWhisperer
SplunkTrust
SplunkTrust

It sounds like error is not a field that has been extracted from your events.

Can you share some sample events, assuming you need help extracting the error field?

0 Karma

Khanu89
Explorer

Here is a example from my dashboard.

Khanu89_0-1650042084627.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

What fields do you already have extracted?

You don't appear to have a field called error (note that field names are case sensitive).

Assuming that the fields that appear to be in your event, you could try

| stats count by ErrorCode
0 Karma

Khanu89
Explorer

@ITWhisperer I am running the following which breaks down different categories but how can I break down the Error type to percentage of errors such as 20% 404, 15% 503 etc..

index=epic_ehr
|stats count by Type

Screen Shot 2022-04-21 at 5.02.30 PM.png

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...