topic I need to group results based on a threshold in Splunk Search

I need to group results based on a threshold

mkwan0 — Wed, 28 Aug 2013 15:45:56 GMT

I am running a query against a webserver access log. I need to group all responses greater than 5 seconds, and determine what percentage of all responses are in the above 5 second group. Any thoughts?

Re: I need to group results based on a threshold

Ayn — Wed, 28 Aug 2013 17:33:21 GMT

You could use stats with eval for this:

... | stats count(eval(response_time>=5)) as slow_response_count

Re: I need to group results based on a threshold

mkwan0 — Mon, 28 Sep 2020 14:40:30 GMT

Ayn, thanks

I had come up with this
earliest=-y latest=now | timechart count(eval(serve_request_time_sec<5)) As WithinSLA, count(eval(serve_request_time_sec>5)) As OverSLA

Now I just need to divide the OverSLA group by OverSLA+WithinSLA. Is there a way to do that within Stats or Timechart

As you probably guessed, I am fairly new to Splunk, and reading documentation as I go.