Splunk Search

How would I write a Splunk search to build a table for PASS and FAIL?

super_edition
Path Finder

Hello Everyone,

I have below query with which I am trying to build a table showing data for SUCCESS  for sum of statusCode starts with 20* and FAIL for sum of statusCode starts with 4*. 

However with the below query,

 

 

index=my_index sourcetype=openshift_logs openshift_namespace=my_ns  openshift_cluster="cluster009"
("message.statusCode"=20* OR "message.statusCode"=4*) 
| search "message.logType"=CLIENT_RES 
| search "message.url"="/shopping/carts/*"  
| timechart span=1h dc("message.tracers.id{}") as count by message.statusCode

 

 

 I am getting the table as below:

_time 200 201 400 403
2023-05-28 03:00 400 10 10 11
2023-05-28 04:00 301 99 19 0
2023-05-28 05:00 100 45 11 9

 

I am expecting table as something like this:

_time success fail
2023-05-28 03:00 410 21
2023-05-28 04:00 400 19
2023-05-28 05:00 145 20

 

Not sure how to change this.

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=my_index sourcetype=openshift_logs openshift_namespace=my_ns  openshift_cluster="cluster009"
("message.statusCode"=20* OR "message.statusCode"=4*) 
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES 
| search "message.url"="/shopping/carts/*"  
| timechart span=1h dc("message.tracers.id{}") as count by status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

Try something like this

index=my_index sourcetype=openshift_logs openshift_namespace=my_ns  openshift_cluster="cluster009"
("message.statusCode"=20* OR "message.statusCode"=4*) 
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES 
| search "message.url"="/shopping/carts/*"  
| timechart span=1h dc("message.tracers.id{}") as count by status
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...