Table per size and error code

[LCM]

Hi all,

A though one for me, but maybe an easy one for you! I want to count error messages and show it in a table per size range.

Please 'enhance' the command: index="myindex" source="mysource" host="myhost" [your-magic]

I appreciate any creative ideas as long as it looks similarish as below 🙂

Output:

Message Size (KB)   failure    debug    error    NOT failure/debug/error
0-100               13         21       0        3939 
100-200             10         16       0        3
200-500             52          6       3        0
500-1000            29          2       35       5
>1000                0          0       58       0

Cheers,
Martin

[Ledion_Bitincka · Accepted solution]

you can easily create that table by following these steps:

1. compute the Message Size field and create the ranges you like
2. create another field for the columns you need to have (below I assume you already have it and it's name is log_level)
3. use the chart command to generate your table

Here's an example:

.... | eval ms=len(_raw) | eval MessageSize=if(ms<100, "0-100", if(ms<200, "100-200", ">200")) | chart count over MessageSize by log_level