Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Re: interface wise success and error bar chart on ...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
How to represent interface wise success and error bar chart on a single dashboard?
I want to represent interface wise (DFOINTERFACE) success and failure
success log below, where completed successfully is main keyword:
2022-12-06 14:43:21:064 EST| INFO |dfo_.allocation DFOINTERFACE=dfo_.allocation START -- dfo_.allocation Execution accountNumber=%productValidationRequest/accountNumber/accountBase%%productValidationRequest/accountNumber/accountDest% completed successfully MFRESPONSETIME=96 millisec 176 microsec 997 nanosec MFPROGRAMEID=OMCRCAL1 Service Name : LowCodePlatform.RESTService.allocation:_post
and error log below, where completed with Error is main keyword:
2022-12-06 13:52:38:233 EST| ERROR |dfo_.productValidation DFOINTERFACE=dfo_.productValidation START -- dfo_.productValidation Execution accountNumber=076732008 completed with Error 20120014 - CICS ECI Connection: Transformation error on reply: Invalid decimal digit: MFRESPONSETIME=411 millisec 753 microsec 627 nanosec MFPROGRAMEID=OECDFB21 Service Name : LowCodePlatform.RESTService.ProductValidation
I want a report like, please see the attachment
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
You are able to, you just don't know how to. 😀
Here's one way.
host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" ("completed successfully" OR "completed with error")
```Check the status of each event```
| eval status = if(searchmatch("completed successfully"), "success", "error")
```Count the results and group them by interface and status```
| stats count by DFOINTERFACE,status
```Rearrange the results```
| xyseries DFOINTERFACE status countIf this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
What have you tried so far? How did those attempts not meet your needs?
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
your solution was perfect. It solved my problem
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
If your problem is resolved, then please click the "Accept as Solution" button to help future readers.
If this reply helps you, Karma would be appreciated.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have tried separately.
Please see the attachment
for success log interface wise
host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed successfully |stats count by DFOINTERFACE
and for failure log interface wise
host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed with error |stats count by DFOINTERFACE
I am unable to combine both together.
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
