Splunk Search

How to separate fields and create a pie chart of status count?

thaara
Explorer

Hi Splunkers,

Please guide us on the requirement below:

Input:

server, env, req no, input field,status
host-1,PROD,1666680,mobile1,Deployment_Successful
host-1,PROD,1666680,mobile2,Deployment_failed
host-1,PROD,1666680,mobile3,exception
host-1,PROD,1666001,mobile1,Deployment_Successful
host-1,PROD,1666601,mobile2,Deployment_failed
host-1,PROD,16666801,mobile3,exception

Expected output: Pie chart with status count

My trial:

sourcetype=sourcetype1 source=*.log  
| rex field=_raw "(?\w+\-\d+)\,(?\w+\/\w+)\,(?\d+)\,(?\w+)\,,(?\w+.*)" 
| stats count by Status

The above search is not showing the count if the log has different statuses. Kindly help to guide on this.

Labels (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Try this run-anywhere example, which displays a pie chart with 3 segments.

| makeresults | eval _raw="host-1,PROD,1666680,mobile1,Deployment_Successful|
 host-1,PROD,1666680,mobile2,Deployment_failed|
 host-1,PROD,1666680,mobile3,exception|
 host-1,PROD,1666001,mobile1,Deployment_Successful|
 host-1,PROD,1666601,mobile2,Deployment_failed|
 host-1,PROD,16666801,mobile3,exception" | eval _raw=split(_raw, "|") | mvexpand _raw
`comment("All of the above just sets up test data")`
 | rex field=_raw "(\w+\-\d+)\,(\w+)\,(\d+)\,(\w+),(?<Status>\w+.*)"
 | stats count by Status

alt text

---
If this reply helps you, Karma would be appreciated.
0 Karma

thaara
Explorer

@richgalloway
I want to take input data from a log file instead of giving input in my query. Kindly help on that.

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Replace everything above the comment with the SPL you use to input data from your log file. For example,

sourcetype=sourcetype1 source=*.log
| rex field=_raw "(\w+\-\d+)\,(\w+)\,(\d+)\,(\w+),(?<Status>\w+.*)"
| stats count by Status
---
If this reply helps you, Karma would be appreciated.
0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please edit your question to correct the rex command. Also, please share your results and the desired output.

---
If this reply helps you, Karma would be appreciated.
0 Karma

thaara
Explorer

sourcetype=sourcetype1 source=.log | rex field=_raw "(?\w+-\d+)\,(?\w+\/\w+)\,(?\d+)\,(?\w+)\,(?\w+.)" | stats count by Status

Output am getting as NONE in pie chart view.

please note: If i have only one kind of status example as "deployment_successful" in my log, I can seethe count, but if there are different statuses, I cannot create a pie chart

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Your regular expression (rex command) doesn't match the data.

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Splunk Life | Happy Pride Month!

Happy Pride Month, Splunk Community! &#x1f308; In the United States, as well as many countries around the ...

SplunkTrust | Where Are They Now - Michael Uschmann

The Background Five years ago, Splunk published several videos showcasing members of the SplunkTrust to share ...

Admin Your Splunk Cloud, Your Way

Join us to maximize different techniques to best tune Splunk Cloud. In this Tech Enablement, you will get ...