Currently I am using the search below to generate an error codes report in my application.
source="log_file_name.log" | rex "(?<errorCode>OPT-\w{6})" | timechart span=1d count by errorCode usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc
It's showing the results as below.
When there are more error codes, then it's currently required to scroll the horizontal line bar. Instead, is there any possibility to switch Time to the X-Axis and Error Codes on Y-Axis in the table?
Try this
source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc
Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart
Try this
source="log_file_name.log" | rex "(?<errorCode>OPT-w{6})" | chart count over errorCode by tiime usenull=f useother=f | rename _time as Time | eval Time=strftime(Time, "%d-%b-%Y") | sort date_numericmonth desc
Adjust the search according to your requirement . For reference : http://docs.splunk.com/Documentation/Splunk/6.1/SearchReference/chart