Splunk Search

Combining two search and charting successfull event and errors in one chart.

kermit_maness
Engager

Hello everyone,

Seeking your help. I have  logs where Transaction_ID is unique to  transaction. Depending on each transaction there can be multiple action. But if there is an error there would be a log generated with Action=Error.

I have created two search 

One for successfull creation of transaction:

`base_search` | search action=Error | timechart distinct_count(Transaction_ID) as Successfull

And for errors.

`base_search` | search action!=Error | timechart distinct_count(Transaction_ID) as Error.

I would like to simply display these two in one chart to see number of successfull events vs failed. What would be the best method to combine these two ?

 

Appreciate any guidance.

Labels (4)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what time value you want to chart so I have assumed the last time for the transaction, I have also assumed you want daily counts. Gather the actions per transaction, and set status based on whether "error" is one of the status for the transaction.

| stats values(actions) as actions last(_time) as _time by transactionid
| eval status=if(match(actions,"error"),"Error","Successful")
| timechart span=1d dc(transactionid) by status

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

It is not clear what time value you want to chart so I have assumed the last time for the transaction, I have also assumed you want daily counts. Gather the actions per transaction, and set status based on whether "error" is one of the status for the transaction.

| stats values(actions) as actions last(_time) as _time by transactionid
| eval status=if(match(actions,"error"),"Error","Successful")
| timechart span=1d dc(transactionid) by status
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...