Splunk Search

How to group results from two rex together into one Column Chart?

lordhans
Explorer

I am doing a search query where there will be a dynamic client ID with either a success or a failure result code -- I want to look at all the successes and failures based on a client ID.

The client ID always comes after the method name, a comma, the code (for success or failure), a space and comma, then the client ID followed by a comma. This is an example of what the event logs look like:

<A bunch of random logging stuff> ~aStaticMethodName,SuccessOrFailureCode5555 ,ClientID, <Another bunch of random logging stuff>

I am using 'rex' to find the Client IDs for both the successes or failures by client ID like this:

"My Search Here" 
| rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
| rex "~myMethod,failureCode1111 ,(?<failure>[^,]+),"

I then add a | chart count by success (or change the success to failure) and can get an output looking like this:

alt text

The successes and failures will have common client IDs (client A, client B, etc).

What I want to do, is combine both success and failure into one chart grouped by client ID like this:

alt text

Is there a way to do this in Splunk? Help is greatly appreciated!

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

try something like this:

"My Search Here" 
 | rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
 | rex "~myMethod,failureCode1111 ,(?<failure>[^,]+)," 
 | eval clients=coalesce(success,failure)
 | stats count(success) as success count(failure) as failure by clients

View solution in original post

somesoni2
Revered Legend

Try like this

"My Search Here" 
 | rex "~myMethod,(?<status>[^,]+) ,(?<clientID>[^,]+)," 
 | replace "successCode0000" with "Success" "failureCode1111" with "Failure" in status
| chart count over clientID by status

cmerriman
Super Champion

try something like this:

"My Search Here" 
 | rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
 | rex "~myMethod,failureCode1111 ,(?<failure>[^,]+)," 
 | eval clients=coalesce(success,failure)
 | stats count(success) as success count(failure) as failure by clients
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...