Splunk Search

Question about subsearch

Min1025
Explorer

Hi all,

I have below query and the results like below table, is there a way that only search and display total count for the Users who have error(User1, User2, User3)?

   index=aaa sourcetype=bbb |eval errorByService=case(ErrorCode=400 AND match(uri,"/service1/*"),"service1",ErrorCode=400 AND match(uri,"/service2/*"),"service2",ErrorCode=400 AND match(uri,"/service3/*"),"service3")|stats count  as ErrorCnt by User errorByService 
|appendcols [search index=aaa sourcetype=bbb |eval totalByService=case(match(uri,"/service1/*"),"service1",match(uri,"/service2/*"),"service2", match(uri,"/service3/*"),"service3")|stats count as Total by User totalByService] |eval ErrorRate=ErrorCnt/Total |fields User, errorByService, ErrorCnt, totalByService, Total, ErrorRate

alt text

Tags (3)
0 Karma
1 Solution

HiroshiSatoh
Champion

It is possible with ”addcoltotals” if you add a field for calculation.

(your search)
|eval Error=if(isnull(ErrorCnt),0,1)
|addcoltotals labelfield=User label=TOTAL Error

View solution in original post

0 Karma

HiroshiSatoh
Champion

It is possible with ”addcoltotals” if you add a field for calculation.

(your search)
|eval Error=if(isnull(ErrorCnt),0,1)
|addcoltotals labelfield=User label=TOTAL Error
0 Karma

Min1025
Explorer

Hi HiroshiSatoh,

Thank you for your answer. Maybe there is a ambiguity for my question. My question is if it possible the User range for subsearch is only for those user who have error.

In subsearch, it searched all Users' data, the results shows the "Total" for User1, User2...User8, but only User1,User2, User3 have error, I want to only search and show "Total" for User1,User2, User3 in subsearch, is it possible?
Expected results:
User errorByService ErrorCnt totalByService Total ErrorRate
User1 service1 2 service1 20 0.1
User2 service1 3 service1 24 0.125
User3 service2 5 service2 35 0.142857143

0 Karma

HiroshiSatoh
Champion

I'm sorry I do not understand what I want to do.

If only to extract
(your search)
|where where isnotnull(ErrorCnt)

If conditional summary ex・・・
|stats sum(eval(if(isnotnull(ErrorCnt), Total,0))) AS Total

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...