How to breakdown errors in charts group by error codes in error tables or list?

[Khanu89]

Hello - I am a new Splunk user and learning as I go. My current task is to breakdown Errors/Exceptions in chart group by error codes in error tables or list.

current query: My current query  only returns null values.

index= (index name) host=(hostname)

| timechart count by error

[Gr0und_Z3r0 · Accepted solution]

Hi @Khanu89 

For your pie-chart, in the xml code add the following option configuration.

<option name="charting.chart.showPercent">1</option>

You should be able to see the percentage details against each category in the chart.
Something like below.

Gr0und_Z3r0_0-1650587337249.png

If it helps, Karma vote is appreciated

[ITWhisperer]

It sounds like error is not a field that has been extracted from your events.

Can you share some sample events, assuming you need help extracting the error field?

[Khanu89]

Here is a example from my dashboard.

Khanu89_0-1650042084627.png

[ITWhisperer]

What fields do you already have extracted?

You don't appear to have a field called error (note that field names are case sensitive).

Assuming that the fields that appear to be in your event, you could try

| stats count by ErrorCode

[Khanu89]

@ITWhisperer I am running the following which breaks down different categories but how can I break down the Error type to percentage of errors such as 20% 404, 15% 503 etc..

index=epic_ehr
|stats count by Type

Screen Shot 2022-04-21 at 5.02.30 PM.png