How to get count of successful events after failure?

[Pjyoti]

Hi,

I have a use case where in i want to find out how many download api failed for a given document and how many out of the failed were successful after subsequent call

I have no clue how to search this on splunk

right now I am finding the failed ones using the below query 

index=ty_ss “download/docIds?=“ “500”  | Rex “docId=(?<docId>.*)” | eval event_time = strftime() | table docIds, event_time

[scelikok]

Hi @Pjyoti,

Can you please share a few log lines? Because it seems user and API return values should be extracted before analysis.

[Pjyoti]

sample logs attached

[Pjyoti]

Hi any update ??

Can someone help

[scelikok]

Hi @Pjyoti,

You can use streamstats to count successful downloads by resetting on fail.

https://docs.splunk.com/Documentation/Splunk/9.0.3/SearchReference/Streamstats#The_reset_on_change_a...

Please try below sample; 

index=ty_ss 
| streamstats count as success_count by http_response reset_after=(http_response=500)  

[Pjyoti]

I think my question was not clear so the requirement here is that I need to find the below things :

1. How many documents failed with 500 error which is straightforward 

2. how many documents failed first time for all users and after how many retries were they successful (if they were) or were they not retried at all ?

I am stuck at the second case

i am not understanding how do I group the document and show a retry number if it wasn’t retried at all then it should give 0 if the retries didn’t work they should give some other result and if the retries were successful after how many attempts were they successful.

[Pjyoti]

By successful I mean the api returned 200 for that doc for that user