Active Error Count

Show the total number of errors in a system as a single prominent number for at-a-glance monitoring. Useful on an operations dashboard where you want to know immediately whether errors are occurring, without drilling into a chart.

Visualization: the widget displays a single large number representing the total count of error events in the selected time window. The Single Value widget automatically selects the first numeric field it finds in the query result (_count in this case) and uses it as the displayed value:

Screenshot showing a single value widget displaying a large error count number centered on a dark background with a 24-hour time range indicator

Figure 249. Active Error Count


Sample input data:

@timestamphostloglevelmessageservice
1970-01-01T00:00:02svc-01errorConnection timeout after 30spayment-service
1970-01-01T00:00:02svc-02errorAuthentication token expiredauth-service
1970-01-01T00:00:02svc-03infoUser login successfuluser-service
1970-01-01T00:00:02svc-04errorMemory limit exceededanalytics-service
1970-01-01T00:00:02svc-05warnCache eviction triggeredcache-service

Query:

logscale
loglevel = /error/i
| count()

Query breakdown:

  1. Filters events where the loglevel field matches the pattern error (case insensitive).

  2. Counts all matching events and stores the result in the _count field. This produces a single-row result, which the Single Value widget uses as the displayed number.

Configuration:

  1. From the Search page, type your query in the Query Editor → click Run

  2. Choose Single Value in the Widget selector

  3. Click the style icon : this opens the Format panel on the side.

  4. In Text, enter a Label such as Active Errors to describe the displayed value. Optionally configure Color thresholds to highlight when error counts exceed a critical level.

To customize this widget further, see Single Value Property Reference.