I want to search 2 strings in log file, like "A string" & "B String", A string should be treated as successful and B as Failure. Next I want to overlay both as line timechart, where successful events should go above x-axis and Failure events go below x-axis or they are showed as different colors.How this can be done?
You should post this as a new question, or a comment, instead of an answer to the top question.
But to answer your answer: You can create an alias (called a search macro in Splunk) for a search string in the GUI under Settings - Advanced Search - Search Macros. To use the macro once it's been created, you have to surround your macro with backticks, like this:
. The parenthesis are best to include, since there are cases where they are required even if you have no arguments.
As for span, you can use
span=1d. Check the
timechart search command help and you will find the
span option along with some example usage.
I knew that I had to post as new question and I even tried but continously gave me form error. That the reason I posted my question as an answer.
Anyways Thank you so much for the reply. it worked.
Sorry for inconvenience caused.
Thank you Iguinn,
It almost worked but how do I give alias to search string? My timechart shows Success and failure which I don't wanna show instead I want to give alias to them and also span for a day,Hi Thank you for your answer it almost worked but how do I give alias for search string and search for span of a 1day
There are many ways, but this might be easiest.
source=logfilename "A string" | eval series = "Success" | append [ search source=logfilename "B string" | eval series = "Failure" ] | timechart count by series