I want to search 2 strings in log file, like "A string" & "B String", A string should be treated as successful and B as Failure. Next I want to overlay both as line timechart, where successful events should go above x-axis and Failure events go below x-axis or they are showed as different colors.How this can be done?
How can I do a timechart with 2 strings and also give a Alias names to the string . How can span the reults for 1 day within same query?
You should post this as a new question, or a comment, instead of an answer to the top question.
But to answer your answer: You can create an alias (called a search macro in Splunk) for a search string in the GUI under Settings - Advanced Search - Search Macros. To use the macro once it's been created, you have to surround your macro with backticks, like this:
. The parenthesis are best to include, since there are cases where they are required even if you have no arguments.myawesomemacro()
As for span, you can use span=1d
. Check the timechart
search command help and you will find thespan
option along with some example usage.
Hi,
I knew that I had to post as new question and I even tried but continously gave me form error. That the reason I posted my question as an answer.
Anyways Thank you so much for the reply. it worked.
Sorry for inconvenience caused.
Thank you Iguinn,
It almost worked but how do I give alias to search string? My timechart shows Success and failure which I don't wanna show instead I want to give alias to them and also span for a day,Hi Thank you for your answer it almost worked but how do I give alias for search string and search for span of a 1day
There are many ways, but this might be easiest.
source=logfilename "A string"
| eval series = "Success"
| append [ search source=logfilename "B string"
| eval series = "Failure" ]
| timechart count by series