Splunk Search

token passage

sahana
Engager

Hi ,

I have requirement like there two panels, in which the 1st one has success and failure as a column name and on click of these success or failure count a drill down panel should show the result.

these success and failure was categorized by below values in logs like

statusCode = 200 , then its is success

statusCode = 400 or 500, then it is failure

 

as said above the drilldown panel should show result on selection of the success/ failure count.

it tried with below query it is not working 

having token as $col$ which gets selection of that column name(Success/Failure)

query is

message.flow="individual" | eval status=$col$| eval source= case(status=="Success",200,status=="Failure",400 OR 500) | message. statusCode= source| table time,details, message. statusCode

kindly help on fixing it. the parameter value of source should be passed to the message.statusCode

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @sahana,

at first I see that there's an error (probably for cut & past) of missing eval before message.StatusCode,

Then I hint to avoid dot "." in field names, use always underscore "_", if there's a dot rename it.

The main question is: what do you pass on click: "click.value" or "click.name"?

You should pass the "click.name" value to have "Success" or "Failure"; beware to the upper or lower case that must be the same!

In few words, passing on click the "click.name" value as token  I'd use a different approach:

your_search 
| rename message.flow AS message_flow
| eval message_flow="individual" 
| eval status=$col$
| eval statusCode=case(status="Success",200,status="Failure","400 or 500") 
| table time details statusCode

Ciao.

Giuseppe

 

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...