The below search String works same for approved and decline. Can some let me know where the error is?
All the time it executes index="pg_int" sourcetype="pg" (responseCode=00)
for approved and declined. Please help.
index="pg_int" sourcetype="pg" (responseCode=00) | timechart count as approved | appendcols [search index="pg_int" sourcetype="pg" (responseCode!=00)| timechart count as declined]
For the appendcols
to align correctly, try adding a span
to your timechart
. Something like this
index="pg_int" sourcetype="pg" (responseCode=00) | timechart span=1d count as approved | appendcols [search index="pg_int" sourcetype="pg" (responseCode!=00)| timechart span=1d count as declined]
Having said that, a faster approach may be this...
index="pg_int" sourcetype="pg" responseCode=* | eval response_cd=if(responseCode="00", "approved" , "declined") | timechart span=1h count by response_cd
For the appendcols
to align correctly, try adding a span
to your timechart
. Something like this
index="pg_int" sourcetype="pg" (responseCode=00) | timechart span=1d count as approved | appendcols [search index="pg_int" sourcetype="pg" (responseCode!=00)| timechart span=1d count as declined]
Having said that, a faster approach may be this...
index="pg_int" sourcetype="pg" responseCode=* | eval response_cd=if(responseCode="00", "approved" , "declined") | timechart span=1h count by response_cd
Thanks Sundar!!!
The faster approach worked fine but I wonder why the appendcols still didn't work after the changes.I am using Splunk 6.1 and IE11
Can you please help me how to restrict specific responseCode for decline?
responseCode =90 or responseCode = 08 consider as Decline.
Change the eval
segment like this
.... | eval response_cd=case(responseCode="00", "approved", responseCode="90" OR responseCode="08", "declined", 1=1, "other")
The other
for all other responseCodes. If you don't want to show that field, you can add this to the end of the query
| fields - other