Splunk Search

Timechart by field in tabular format

pankajad
Explorer

There are 100s  of APIs in my application. I'm logging exception for an API. I can get stats to get total no of exception in a time window by using 

 

Exception |stats count by uri

 

This will give me result in tabular format exception count for each uri.

However, I would like to get this data in timechart for each uri. This can easily be done if I hardcode the uri and get exception count on time series but I don't want to do this for 100s of APIs.

pankajad_0-1624773718582.png

 | timechart count by api puts many under OTHER and NULL category. However,  I would want api as row and time as column..preferably in visual format - timechart against each api

 

Labels (4)
Tags (1)
0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@pankajad 

Can you please try something like this?

uri=* Exception | timechart usenull=f useother=f count by uri

 

KV 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
Exception | timechart count by uri
0 Karma

pankajad
Explorer

I had tried timechart but it doesn't solver my issue. I have updated my question with more details

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...

[Puzzles] Solve, Learn, Repeat: Dereferencing XML to Fixed-length events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...

Stay Connected: Your Guide to December Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...