How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

[AmitKrJash]

Hi,
I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the application. The status will be either ERROR or SUCCESS. If the status is SUCCESS, then it is fine but if it is ERROR, it should count the number of ERROR for particular clients and should give the output in tabular format. For example lets say I have 2 clients: Amit@xyz.com and Jash@xyz.com
So the final output should be :
Client_ID Count of ERROR
Amit@xyz.com 25
Jash@xyz.com 54

I tried this query : index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*

So it showing the error status for all clients in the log file, but now my requirement is to get the tabular output like the example I mentioned above.

[renjith_nair · Accepted solution]

Try

index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID

Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuid... as well

[AmitKrJash]

Thanks a lot Renjith!! now I am able to get the required tabular output