How to separate fields and create a pie chart of status count?

[thaara]

Hi Splunkers,

Please guide us on the requirement below:

Input:

server, env, req no, input field,status
host-1,PROD,1666680,mobile1,Deployment_Successful
host-1,PROD,1666680,mobile2,Deployment_failed
host-1,PROD,1666680,mobile3,exception
host-1,PROD,1666001,mobile1,Deployment_Successful
host-1,PROD,1666601,mobile2,Deployment_failed
host-1,PROD,16666801,mobile3,exception

Expected output: Pie chart with status count

My trial:

sourcetype=sourcetype1 source=*.log  
| rex field=_raw "(?\w+\-\d+)\,(?\w+\/\w+)\,(?\d+)\,(?\w+)\,,(?\w+.*)" 
| stats count by Status

The above search is not showing the count if the log has different statuses. Kindly help to guide on this.

[richgalloway]

Try this run-anywhere example, which displays a pie chart with 3 segments.

| makeresults | eval _raw="host-1,PROD,1666680,mobile1,Deployment_Successful|
 host-1,PROD,1666680,mobile2,Deployment_failed|
 host-1,PROD,1666680,mobile3,exception|
 host-1,PROD,1666001,mobile1,Deployment_Successful|
 host-1,PROD,1666601,mobile2,Deployment_failed|
 host-1,PROD,16666801,mobile3,exception" | eval _raw=split(_raw, "|") | mvexpand _raw
`comment("All of the above just sets up test data")`
 | rex field=_raw "(\w+\-\d+)\,(\w+)\,(\d+)\,(\w+),(?<Status>\w+.*)"
 | stats count by Status

[thaara]

@richgalloway
I want to take input data from a log file instead of giving input in my query. Kindly help on that.

[richgalloway]

Replace everything above the comment with the SPL you use to input data from your log file. For example,

sourcetype=sourcetype1 source=*.log
| rex field=_raw "(\w+\-\d+)\,(\w+)\,(\d+)\,(\w+),(?<Status>\w+.*)"
| stats count by Status

[richgalloway]

Please edit your question to correct the rex command. Also, please share your results and the desired output.

[thaara]

sourcetype=sourcetype1 source=.log | rex field=_raw "(?\w+-\d+)\,(?\w+\/\w+)\,(?\d+)\,(?\w+)\,(?\w+.)" | stats count by Status

Output am getting as NONE in pie chart view.

please note: If i have only one kind of status example as "deployment_successful" in my log, I can seethe count, but if there are different statuses, I cannot create a pie chart

[richgalloway]

Your regular expression (rex command) doesn't match the data.