×

Join the Conversation

Without signing in, you're just watching from the sidelines. Sign in or Register to connect, share, and be part of the Splunk Community.
Ask a Question
julescarney
New Member
Member since: ‎09-24-2013
‎06-05-2020
Community Statistics
Posts 3
Solutions 0
Karma Given 0
Karma Received 0
Member Since ‎09-24-2013
View All

Re: How can I create a chart based on two separate...

by in Splunk Search
‎09-24-2013 11:07 AM
‎09-24-2013 11:07 AM
Thanks for the reply. The query you posted gives me 0 results, though if I do CASE(ERROR.) platformtype="CCX*"| stats count by name I get a count of the events with each errorname. Each unique session has a url. Each error event is part of a session, so that first query I posted above finds the urls for all the sessions that had errors, then does the count of events by url. Each event that contains an error has an errorname ("name"). However, non-error events also have names. What I'm trying to chart is this: for each url, how many events contained each errorname. Thanks again. ... View more

Re: How can I create a chart based on two separate...

by in Splunk Search
‎09-24-2013 11:07 AM
‎09-24-2013 11:07 AM
Thanks for the reply. The query you posted gives me 0 results, though if I do CASE(ERROR.) platformtype="CCX*"| stats count by name I get a count of the events with each errorname. Each unique session has a url. Each error event is part of a session, so that first query I posted above finds the urls for all the sessions that had errors, then does the count of events by url. Each event that contains an error has an errorname ("name"). However, non-error events also have names. What I'm trying to chart is this: for each url, how many events contained each errorname. Thanks again. ... View more

How can I create a chart based on two separate sea...

by in Splunk Search
‎09-24-2013 10:25 AM
‎09-24-2013 10:25 AM
I'm trying to create a chart like the one below, that shows the count for events containing errorname A, errorname B, etc. for each url. Basically in my application there are sessions - some of the events in the sessions contain url, and some contain errornames. url    |   errorname    | count http..a |   error.A        | 37       |   error.B        | 20 http..b |   error.A        | 1       |   error.B        | 13 I can get a count of sessions with any error by url with this query: url[search CASE(ERROR.)|fields sessionid | format] | stats count by url I can get a count of events by errorname with this: name [search CASE(ERROR.) AND platformtype="CCX*"| fields eventid | format] | stats count by name But I can't get counts of each errorname for each url. Thanks for any help. ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM