Splunk Search

How to represent interface wise success and error bar chart on a single dashboard?

avikc100
Path Finder

I want to represent interface wise (DFOINTERFACE) success and failure 


success log below, where completed successfully is main keyword:
2022-12-06 14:43:21:064 EST| INFO |dfo_.allocation DFOINTERFACE=dfo_.allocation START -- dfo_.allocation Execution accountNumber=%productValidationRequest/accountNumber/accountBase%%productValidationRequest/accountNumber/accountDest% completed successfully MFRESPONSETIME=96 millisec 176 microsec 997 nanosec MFPROGRAMEID=OMCRCAL1 Service Name : LowCodePlatform.RESTService.allocation:_post

and error log below, where completed with Error is main keyword:

2022-12-06 13:52:38:233 EST| ERROR |dfo_.productValidation DFOINTERFACE=dfo_.productValidation START -- dfo_.productValidation Execution accountNumber=076732008 completed with Error 20120014 - CICS ECI Connection: Transformation error on reply: Invalid decimal digit: MFRESPONSETIME=411 millisec 753 microsec 627 nanosec MFPROGRAMEID=OECDFB21 Service Name : LowCodePlatform.RESTService.ProductValidation

I want a report like, please see the attachment

Labels (5)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You are able to, you just don't know how to.  😀

Here's one way.

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" ("completed successfully" OR "completed with error")
```Check the status of each event```
| eval status = if(searchmatch("completed successfully"), "success", "error")
```Count the results and group them by interface and status```
| stats count by DFOINTERFACE,status
```Rearrange the results```
| xyseries DFOINTERFACE status count
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  How did those attempts not meet your needs?

---
If this reply helps you, Karma would be appreciated.

avikc100
Path Finder

your solution was perfect. It solved my problem

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

avikc100
Path Finder

I have tried separately.
Please see the attachment

for success log interface wise

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed successfully |stats count by DFOINTERFACE

and for failure log interface wise

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed with error |stats count by DFOINTERFACE

I am unable to combine both together.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...