how to generate error count report

[KShen]

I have several query.Each query I have the list of the result.

But I just need to know the report of each of the total number displayed.

For example.

the query:
1. "Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0
2. "Not a valid request object from query" earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0

the report like:

error type total

Error sent back from database: 25
Not a valid request object from query: 38

any idea?

• And another requirement is: dynamic earliest and latest date. all of query use the same earliest and latest date.

[stephanefotso · Accepted solution]

Hello! I know there is several ways to do that, but i will use Event Types to help you attain your objective. Here is the algorithm.

1. launch your first search and save it as an Event Type. For example, if your first search is the one bellow, you can give your Event Type the name error sent back from database

   "Error sent back from database" StatusCode NOT 00051 earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0

   1. launch the second search and do the same. Let suppose you saved it as not a valid reques object from query Event Type
   2. Type this search: eventtype="error sent from database" OR eventtype="not a valid reques object from query"|stats count as Total by eventtype|rename eventtype AS "Error Type"

[KShen]

Thanks a lot for the answer.
Is there a way to get the dynamic date range report.
In another words: Can I set the earliest and latest date, when I run the report?

[stephanefotso]

yes of course! There is several ways to do it. One is that, you can include a timerange picker, and then remove your earliest=2/1/2015:0:0:0 latest=3/1/2015:0:0:0 in your searchString, set the earliest and latest time of your timerange, and then set the earliest and latest time of your search query. Here is an example:

<form > 
  <label>compare a Table values </label>
  <fieldset submitButton="false" autoRun="true">
    <input type="time" token="time" searchWhenChanged="true">
      <label/>
      <default>
        <earliestTime>-1d</earliestTime>
        <latestTime>now</latestTime>
      </default>
    </input>
  </fieldset>
  <row>
  <table >
      <title >Table of Count Sourcetypes Between $time.earliest$ and $time.latest$ for index= $index$ </title>
      <searchString>index=$_internal | stats count as total_count  by sourcetype</searchString>
      <earliestTime>$time.earliest$</earliestTime>
      <latestTime>$time.latest$</latestTime>
      <option name="drilldown">none</option>
      <option name="field">count</option>
    </table>

  </row>
</form>