Hi,
I am new to Splunk. I am trying to figure out how to extract count of errors per api calls made for each client.
I have following query that i run :
`index=application_na sourcetype=my_logs:hec source=my_Logger_PROD retrievePayments* ( returncode=Error OR returncode=Communication_Error) | rex field=message "Message=.* \((?<apiName>\w+?) -" | lookup My_Client_Mapping client | table ClientName, apiName'
This query parses message to extract the apinames that starts with `retrievePayments`. And shows this kind of results
ClientName apiName
Client A retrievePaymentsA
Client B retrievePaymentsA
Client C retrievePaymentsB
Client A retrievePaymentsB
I want to see an output where my wildcard apiName are transposed and show error count for every client.
Client retrievePaymentsA retrievePaymentsB retrievePaymentsC retrievePaymentsD
Client A 2 5 0 1
Client B 2 2 1 6
Client C 8 3 0 0
Client D 1 0 4 3
Any help would be appreciated.
This is a straightforward use of the chart command, see this run anywhere example
| makeresults count=20
| fields - _time
| eval ClientName=mvindex(split("ABC",""), random() % 3)
| mvexpand ClientName
| eval ClientName="Client ".ClientName
| eval apiName="retrievePayments".mvindex(split("ABCD",""), random() % 4)
| chart count over ClientName by apiName
This sets up some example data and then uses the chart command do to the tabling you need.
This is a straightforward use of the chart command, see this run anywhere example
| makeresults count=20
| fields - _time
| eval ClientName=mvindex(split("ABC",""), random() % 3)
| mvexpand ClientName
| eval ClientName="Client ".ClientName
| eval apiName="retrievePayments".mvindex(split("ABCD",""), random() % 4)
| chart count over ClientName by apiName
This sets up some example data and then uses the chart command do to the tabling you need.