topic Re: Help with a query to calculate percentage in Splunk Enterprise

Help with a query to calculate percentage

sunny_871 — Wed, 19 Jul 2023 15:06:25 GMT

Hello, I am working on a query where I need to set an alert based on failure percentages. Calculating the failure percentage is the tricky part. Here is my sample query -

index=myindex (status=success OR status=inprogress) | bin _time | stats count(eval(like(status, "success"))) as success count(eval(like(status, "inprogress"))) as inprogress by id _time

The conditions for access and failure are as below -

Success -

| where success = 1 AND inprogress >=1

Failure -

| where success = 0 AND inprogress >=1

Now I want to create an alert based on failure percentage of 10%. How do i calculate the failure and success percentage here? The id you are seeing in the BY clause is nothing but customer ID so I'd like to get alerted based on 10% failure,

Best Regards

Re: Help with a query to calculate percentage

ITWhisperer — Wed, 19 Jul 2023 15:35:13 GMT

Your search looks a little odd for what you are trying to do although it does depend on your data.

Since you have _time in your by clause, it is likely that your success count is likely to be either 1 or zero, same with the inprogress count.

If you remove the _time from your by clause, you will get the counts across the whole of the time period of the search (which might be what you actually want)

You can then do an eval based on your criteria for success or failure and count those again over the time period of your search using another stats command.

Finally, you can do an eval to determine the percentage success of all the events within the time period

Re: Help with a query to calculate percentage

sunny_871 — Wed, 19 Jul 2023 17:26:19 GMT

Hi @ITWhisperer Thanks for the response. I have removed the _time.

Sorry how would i create or generate an eval with the below success and failure conditions? Could you give me a guidance.,

Best Regards,
Shashank

Re: Help with a query to calculate percentage

ITWhisperer — Wed, 19 Jul 2023 17:53:23 GMT

| eval status=case(success = 1 AND inprogress >=1, "success", success = 0 AND inprogress >=1, "failure")