Timechart issue

[clementros]

Hi all,

I have extracted a field (exit_status) in log file. I want to know if a process exit properly.

I have 3 use cases that can be found in log files, exit_status = normaly, exit_status= -1 or exit_status not exist.

I want to have a visualisation wich count the number of exit_status = normaly and the number of file that not exit normaly ( exit_status = -1 + exit_status do not exist)

I don't know how to create a counter of existing value (-1) plus the number of file where exit_status do not exist.

[gcusello · Accepted solution]

Hi @clementros,
a little question: have you a process_id that permits to correlate begin process with exit_status?
if yes it's easy to build your search, otherwise you have to find a way to count the executed processes.

In the first case you could have something like this:

index=your_index (process_id=* OR exit_status=*)
| stats values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| table process_id exit_status

In the second case you can have only a total of the processes without exit_status.

Ciao.
Giuseppe

[clementros]

Hi @gcusello

Thank you for your help. The result is good but i do not know how to plot this with a exit_status value count every day

[gcusello]

Hi @clementros,
Try something like this:

index=your_index (process_id=* OR exit_status=*)
| stats earliest(_time) AS _time values(exit_status) AS exit_status BY process_id
| fillnull value="No exit_status" exit_status
| timechart span=1d count BY exit_status

Ciao.
Giuseppe

[clementros]

It works than you