Splunk Search

How to represent interface wise success and error bar chart on a single dashboard?

avikc100
Path Finder

I want to represent interface wise (DFOINTERFACE) success and failure 


success log below, where completed successfully is main keyword:
2022-12-06 14:43:21:064 EST| INFO |dfo_.allocation DFOINTERFACE=dfo_.allocation START -- dfo_.allocation Execution accountNumber=%productValidationRequest/accountNumber/accountBase%%productValidationRequest/accountNumber/accountDest% completed successfully MFRESPONSETIME=96 millisec 176 microsec 997 nanosec MFPROGRAMEID=OMCRCAL1 Service Name : LowCodePlatform.RESTService.allocation:_post

and error log below, where completed with Error is main keyword:

2022-12-06 13:52:38:233 EST| ERROR |dfo_.productValidation DFOINTERFACE=dfo_.productValidation START -- dfo_.productValidation Execution accountNumber=076732008 completed with Error 20120014 - CICS ECI Connection: Transformation error on reply: Invalid decimal digit: MFRESPONSETIME=411 millisec 753 microsec 627 nanosec MFPROGRAMEID=OECDFB21 Service Name : LowCodePlatform.RESTService.ProductValidation

I want a report like, please see the attachment

Labels (5)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

You are able to, you just don't know how to.  😀

Here's one way.

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" ("completed successfully" OR "completed with error")
```Check the status of each event```
| eval status = if(searchmatch("completed successfully"), "success", "error")
```Count the results and group them by interface and status```
| stats count by DFOINTERFACE,status
```Rearrange the results```
| xyseries DFOINTERFACE status count
---
If this reply helps you, Karma would be appreciated.

richgalloway
SplunkTrust
SplunkTrust

What have you tried so far?  How did those attempts not meet your needs?

---
If this reply helps you, Karma would be appreciated.

avikc100
Path Finder

your solution was perfect. It solved my problem

richgalloway
SplunkTrust
SplunkTrust

If your problem is resolved, then please click the "Accept as Solution" button to help future readers.

---
If this reply helps you, Karma would be appreciated.
0 Karma

avikc100
Path Finder

I have tried separately.
Please see the attachment

for success log interface wise

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed successfully |stats count by DFOINTERFACE

and for failure log interface wise

host="uxxxxh-wxxxxx*.axxx.txxx.com" source="/apps/WebMethods/IntegrationServer/instances/default/logs/DFO.log" completed with error |stats count by DFOINTERFACE

I am unable to combine both together.

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...