Success/Failure sum for each day

[zachary_hickman]

Hey, so I have a lot of trouble with bins, and I feel as though this should be an easy solution but I'm having some trouble. I have data that comes in like this:

CONSTANT field1=value success=# failure=#

Where constant is to identify what is being logged, the value of field1 is how I want the data separated, and the total number of success and failures for this field.

I would like to create a graph that puts the successes for ALL values of field1 in the log for a single day (span=1d) stacked together next to all of the failures stacked together, and within the success and failure stacks, the individual field1s that make up the stacks are separated as different colors. Any ideas?

[gkanapathy]

I don't think this gives you what you want, but it's a couple steps away:

... | bin _time span=1d | stats sum(success) as success sum(failure) as failure by _time,field1

or

... | timechart span=1d sum(success) as s sum(failure) as f by field1

This gives you the data you want, but I think that unfortunately the default Splunk charting capabilities don't let you display the data in the way you want. Specifically, the timechart will only really graph 3 dimensions well (time, count of success/failure, and series/field1) and you really want it to show 4 dimensions (time, count, series/field1, success/failure). More simply, it won't let you create more than one stack per time interval, and you want two of them.

Now, you can do some dirty trick to try to fake this by coding success/failure inside of time, e.g.:

... | bucket _time span=1d | stats sum(success) as s sum(failure) as f by _time,field1 | eval v=mvappend(s,f) | mvexpand v | eval _time=if(v=s,_time,relative_time(_time,"+12h") | timechart span=12h sum(v) as v by field1

which would kind of look right, but the data would be screwy.