"How are these transactions linked together... by a field called "ID"? If so.. just build them with the field ID, and then use one of the MV commands to extract a field with success or failure in it. Paste some samples and…"
The dojo of Splunk. Learn, share, teach, mentor.
Videos
Latest Activity
Nikita posted a discussionCount failures and success via transaction
Hi,I'm a new in Splunk so sorry for the stupid questions.I want to calculate failures in logs.For example we have request log and response log."request" OR ("fail" OR "response") |transaction startsWith=("request") endsWith=("fail" OR "response") maxpause=5s keepevicted=false maxspan=25s id |eval Failure=if(searchmatch("fail"),1,0)| eval Success=if(searchmatch("response"),1,0) | stats count(Failure) as FailureCount, count(Success) as SuccessCount | table FailureCount SuccessCountThat query…See More
Making a dashboard searchable?
Hey everyone.
I have a pretty specific goal with a dashboard I'm working on. I'd like the initial dashboard to show a series of charts which will show the status of the system whose data we're taking as a whole. Also, I'd like to display a text box to the left of that. When a user types in the name of a user, I want the same charts displayed for the system, to be redrawn with the same information but relating solely to that user. Can it be done? How?
Views: 43
Replies to This Discussion
-
Permalink Reply by Michael Wilde on -
Yep...
Its a bit more advanced. Advice
1. Check out the Splunk Developer Manual -- it will help you see how to configure the UI to do exactly what you want.
2. Install the UI Examples app off SplunkBase (or within the "Browse More Apps" tab in Splunk Launcher). That app has most, if not all of the design patterns that the Splunk UI and widgetry are built off of. No coding required, just XML modification--which can be tricky, but if you go one step at a time--not too hard.
© 2012 Created by Michael Wilde.
