Splunk Search

How to group results from two rex together into one Column Chart?

lordhans
Explorer

I am doing a search query where there will be a dynamic client ID with either a success or a failure result code -- I want to look at all the successes and failures based on a client ID.

The client ID always comes after the method name, a comma, the code (for success or failure), a space and comma, then the client ID followed by a comma. This is an example of what the event logs look like:

<A bunch of random logging stuff> ~aStaticMethodName,SuccessOrFailureCode5555 ,ClientID, <Another bunch of random logging stuff>

I am using 'rex' to find the Client IDs for both the successes or failures by client ID like this:

"My Search Here" 
| rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
| rex "~myMethod,failureCode1111 ,(?<failure>[^,]+),"

I then add a | chart count by success (or change the success to failure) and can get an output looking like this:

alt text

The successes and failures will have common client IDs (client A, client B, etc).

What I want to do, is combine both success and failure into one chart grouped by client ID like this:

alt text

Is there a way to do this in Splunk? Help is greatly appreciated!

Tags (1)
0 Karma
1 Solution

cmerriman
Super Champion

try something like this:

"My Search Here" 
 | rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
 | rex "~myMethod,failureCode1111 ,(?<failure>[^,]+)," 
 | eval clients=coalesce(success,failure)
 | stats count(success) as success count(failure) as failure by clients

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this

"My Search Here" 
 | rex "~myMethod,(?<status>[^,]+) ,(?<clientID>[^,]+)," 
 | replace "successCode0000" with "Success" "failureCode1111" with "Failure" in status
| chart count over clientID by status

cmerriman
Super Champion

try something like this:

"My Search Here" 
 | rex "~myMethod,successCode0000 ,(?<success>[^,]+)," 
 | rex "~myMethod,failureCode1111 ,(?<failure>[^,]+)," 
 | eval clients=coalesce(success,failure)
 | stats count(success) as success count(failure) as failure by clients
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...