I have the following query: splunk_server=indexer* index=wsi sourcetype=fdpwsiperf (channel_type=ofx2 OR agent_service=OfxAgent) domain=tax api_version=v1 capability=* tax_year=2019 NOT *test* NOT *...
See more...
I have the following query: splunk_server=indexer* index=wsi sourcetype=fdpwsiperf (channel_type=ofx2 OR agent_service=OfxAgent) domain=tax api_version=v1 capability=* tax_year=2019 NOT *test* NOT *jmeter-automation* ofx_codes!="[15500,2000]" | lookup Provider_Alert.csv Provider_ID AS partnerId OUTPUT Tier Form_Type | search Tier=Tier1 | eval time_bucket=case(_time>=relative_time(now(),"-1h"), "last_hour", 1==1, "prior_hour") | eval error_type=case(error_code_host="2000", "OFX_2000", error_code_service IN ("5000","5001"), "provider_unavailable", like(http_status_code_host,"5%"), "HTTP_500",1==1,"null") | eval combo=partnerId."::".provider_id."::".Form_Type."::".host_base_url."::".error_type | chart dc(intuit_tid) as total_requests by combo time_bucket | eval partnerId=mvindex(split(combo,"::"),0) | eval provider_id=mvindex(split(combo,"::"),1) | eval Form_Type=mvindex(split(combo,"::"),2) | eval host_base_url=mvindex(split(combo,"::"),3) | eval error_type=mvindex(split(combo,"::"),4) | fields partnerId provider_id Form_Type host_base_url error_type last_hour prior_hour Which produces a table, where the following result is possible: partnerId provider_id Form_type host_base_url error_type last_hour prior_hour partner1 XYZ FormA urlB null 50 30 partner1 XYZ FormA urlB HTTP 500 12 20 partner2 ABC FormB urlZ null 20 30 I would like to add a column that sums values in last_hour according to grouping by partnerId, so that the above example, I would have another column (ie. extra_column) that has 62 (ie. 50 + 12 = 62) in the two rows for partner1. Extra note: I need the volume breakdown by error_type, but not in a chart format. How can I achieve this?