Splunk Search

how to generate error count report

KShen
New Member

I have several query.Each query I have the list of the result.

But I just need to know the report of each of the total number displayed.

For example.

the query:
1. "Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0
2. "Not a valid request object from query" earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0

the report like:

error type total

Error sent back from database: 25
Not a valid request object from query: 38

any idea?

  • And another requirement is: dynamic earliest and latest date. all of query use the same earliest and latest date.
Tags (3)
0 Karma
1 Solution

stephanefotso
Motivator

Hello! I know there is several ways to do that, but i will use Event Types to help you attain your objective. Here is the algorithm.

  1. launch your first search and save it as an Event Type. For example, if your first search is the one bellow, you can give your Event Type the name error sent back from database

    "Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0

    1. launch the second search and do the same. Let suppose you saved it as not a valid reques object from query Event Type
    2. Type this search: eventtype="error sent from database" OR eventtype="not a valid reques object from query"|stats count as Total by eventtype|rename eventtype AS "Error Type"
SGF

View solution in original post

stephanefotso
Motivator

Hello! I know there is several ways to do that, but i will use Event Types to help you attain your objective. Here is the algorithm.

  1. launch your first search and save it as an Event Type. For example, if your first search is the one bellow, you can give your Event Type the name error sent back from database

    "Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0

    1. launch the second search and do the same. Let suppose you saved it as not a valid reques object from query Event Type
    2. Type this search: eventtype="error sent from database" OR eventtype="not a valid reques object from query"|stats count as Total by eventtype|rename eventtype AS "Error Type"
SGF

KShen
New Member

Thanks a lot for the answer.
Is there a way to get the dynamic date range report.
In another words: Can I set the earliest and latest date, when I run the report?

0 Karma

stephanefotso
Motivator

yes of course! There is several ways to do it. One is that, you can include a timerange picker, and then remove your earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0 in your searchString, set the earliest and latest time of your timerange, and then set the earliest and latest time of your search query. Here is an example:

<form > 
  <label>compare a Table values </label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>-1d</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
  <table >
      <title >Table of Count Sourcetypes Between $time.earliest$ and $time.latest$ for index= $index$ </title>
      <searchString>index=$_internal | stats count as total_count  by sourcetype</searchString>
      <earliestTime>$time.earliest$</earliestTime>
      <latestTime>$time.latest$</latestTime>
      <option name="drilldown">none</option>
      <option name="field">count</option>
    </table>

  </row>
</form>
SGF
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...