Splunk Search

How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

AmitKrJash
Explorer

Hi,
I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the application. The status will be either ERROR or SUCCESS. If the status is SUCCESS, then it is fine but if it is ERROR, it should count the number of ERROR for particular clients and should give the output in tabular format. For example lets say I have 2 clients: Amit@xyz.com and Jash@xyz.com
So the final output should be :
Client_ID Count of ERROR
Amit@xyz.com 25
Jash@xyz.com 54

I tried this query : index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*

So it showing the error status for all clients in the log file, but now my requirement is to get the tabular output like the example I mentioned above.

0 Karma
1 Solution

renjith_nair
Legend

Try

index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID

Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuid... as well

---
What goes around comes around. If it helps, hit it with Karma 🙂

View solution in original post

renjith_nair
Legend

Try

index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID

Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuid... as well

---
What goes around comes around. If it helps, hit it with Karma 🙂

AmitKrJash
Explorer

Thanks a lot Renjith!! now I am able to get the required tabular output

0 Karma
Get Updates on the Splunk Community!

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability

Solve Problems Faster with New, Smarter AI and Integrations in Splunk Observability As businesses scale ...