Splunk Search

How to create this graph in splunk

Anidy21
Engager

I want to create this graph in splunk can some one please help me .

Required graph

Screenshot 2023-04-07 at 8.54.27 AM.png

 The one that i am getting after writing the following query is this

Query - index="BTS-card-account-update" exception="*" ("Payment instrument not found" OR "Wallet already has the updated card") | timechart count by host

Graph after my qurey

Screenshot 2023-04-07 at 9.12.14 AM.png

can some one please tell me how to get two separate line for both kind of exception separately.

Thanks in advance 🙂

 

Labels (2)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @Anidy21,

the problem is that, in the first graph events are plotted by kind of event, instead in your graph are plotted by host, you should try something like this:

index="BTS-card-account-update" exception="*" ("Payment instrument not found" OR "Wallet already has the updated card") 
| eval kind=if(searchmatch("Payment instrument not found"),"Payment instrument not found","Wallet already has the updated card")
| timechart count by kind

Ciao.

Giuseppe

View solution in original post

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Anidy21,

the problem is that, in the first graph events are plotted by kind of event, instead in your graph are plotted by host, you should try something like this:

index="BTS-card-account-update" exception="*" ("Payment instrument not found" OR "Wallet already has the updated card") 
| eval kind=if(searchmatch("Payment instrument not found"),"Payment instrument not found","Wallet already has the updated card")
| timechart count by kind

Ciao.

Giuseppe

0 Karma

Anidy21
Engager

HI @gcusello 

After trying your query i am getting this result , can you please help me writing the query as i am very new to splunk 

Screenshot 2023-04-07 at 10.51.36 AM.png

 Still getting count for one type only

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Anidy21 ,

viewieng your graph, it seems that you have only events containing the string "Payment instrument not found"

could you share som sample of events containing both the strings?

Ciao.

Giuseppe

0 Karma

Anidy21
Engager

Hello @gcusello

yes you are write i only have even containing the string ""payment instrument not found"

when i replace other string which is present in the db i am getting desired graph/result

Thank you so so much for your help 🙂

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @Anidy21 ,

good for you, see next time!

Ciao and happy splunking

Giuseppe

P.S.: Karma Points are appreciated 😉

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...