Splunk Search

How can I use timechart to show a chart of this search with time on x-axis and failure% for each browser on y-axis?

sdep
Engager

This search resulted in a table with columns, browser, failed, success, Failure%
For eg.,

browser    failed    success       Failure%
Chrome     0         2             0
Firefox    2         0             100
IE         0         2             0
IE64       0         2             0

index=... sourcetype=... | rex "(?successful|failed) for the app (?\w+) and browser (?\w+) and region (?\w+)" | where isnotnull(appname) and isnotnull(browser) and region="WEurope" | eval has_failure = if(testResult="failed",1,0) | eval has_success = if(testResult="successful",1,0) | stats sum(has_failure) as failed, sum(has_success) as success by browser | addtotals fieldname=Total | eval Failure%=100*failed/Total | table browser, failed, success, Failure%

alt text

What would be the timechart type of query that I have write to get the time on x-axis, and only failure% for each browser on y-axis?

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Let us say this very gently... to use timechart, there has to be a _time. 😉

 index=... sourcetype=... 
| rex "(?<testResult>successful|failed) for the app (?<appname>\w+) and browser (?<browser>\w+) and region (?<region>\w+)" 
| where isnotnull(appname) and isnotnull(browser) and region="WEurope" 
| eval has_failure = if(testResult="failed",1,0) 
| eval has_success = if(testResult="successful",1,0) 
| bin _time span=1h
| stats sum(has_failure) as failed, sum(has_success) as success by browser _time
| addtotals fieldname=Total 
| eval Failure%=100*failed/Total 
| table _time browser Failure%
| timechart span=1h avg(Failure%) as Failure% by browser

You can modify your time span based on the use case, and the timechart doesn't have to be as granular as the bin is. We just set them both to 1h so that you'd have something to work with.

You'll also have to verify that we properly fixed your rex with whatever the interface deleted.

sdep
Engager

That worked! Thank you very much!

0 Karma

DalJeanis
SplunkTrust
SplunkTrust

@sdep - We're happy to help. If your problem is solved, please accept an answer. You can always upvote any other answers that you found helpful as well (although that's not applicable here).

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...