Splunk Search

How to count the status (ERROR or SUCCESS) for the list of clients accessing the application

Explorer

Hi,
I am a newbie in Splunk Enterprise. I have to write a splunk query to get the status of the clients accessing the application. The status will be either ERROR or SUCCESS. If the status is SUCCESS, then it is fine but if it is ERROR, it should count the number of ERROR for particular clients and should give the output in tabular format. For example lets say I have 2 clients: Amit@xyz.com and Jash@xyz.com
So the final output should be :
Client_ID Count of ERROR
Amit@xyz.com 25
Jash@xyz.com 54

I tried this query : index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*

So it showing the error status for all clients in the log file, but now my requirement is to get the tabular output like the example I mentioned above.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try

index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID

Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuid... as well

View solution in original post

SplunkTrust
SplunkTrust

Try

index="abc_main" sourcetype="def" STATUS=ERROR CLIENT_ID=*|stats count by CLIENT_ID

Start referring to http://docs.splunk.com/Documentation/Splunk/6.2.0/SearchReference/SplunkEnterpriseQuickReferenceGuid... as well

View solution in original post

Explorer

Thanks a lot Renjith!! now I am able to get the required tabular output

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!