topic How do you plot a table of error status codes where there are percentages in the logs? in Splunk Search

How do you plot a table of error status codes where there are percentages in the logs?

saifullakhalid — Sat, 17 Nov 2018 05:03:56 GMT

The below query gives the count of each status code 302, 404, 500 etc , Can you please suggest how should I get the percentage of each error code in the logs.

index=test1 source="/var/log/*ui*"requestOrigin=external (stack_name="*prod*" OR NMG_Stack_Name="*prod*") (requestUrl="*/p/*" OR  requestUrl="*/c*") statusCode!=200 NOT userAgent="*HealthChecker*" | eval rt=responseTime| rex field=requestUrl "((?\/c\/|^\/$))" | stats count as "Count" by  statusCode

Actual Output:

statusCode | Count
301 | 1
302 | 4619
404 | 180

Sample Expected Output:

statusCode | Count. | %Percentage
301 | 1 | %2
302 | 4619. | %20
404 | 180 | %5

Re: How do you plot a table of error status codes where there are percentages in the logs?

FrankVl — Sat, 17 Nov 2018 07:41:00 GMT

A very easy way to do that is to do | top statusCode instead of the stats command.

Note this by default returns only the top 10 results, you can control that by adding limit=N to show the top N results (use 0 to remove the limit). For details see: http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Top

Re: How do you plot a table of error status codes where there are percentages in the logs?

saifullakhalid — Mon, 19 Nov 2018 03:45:01 GMT

My question was how to get the % percentage

Re: How do you plot a table of error status codes where there are percentages in the logs?

FrankVl — Mon, 19 Nov 2018 07:27:34 GMT

Yes, have you tried the top command? That shows the top items along with count and percentage.