topic Re: How do I use the eval command to calculate error rates and show them as percentages? in Splunk Search

How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 16:57:58 GMT

Hello,

I am creating a dashboard in which I am displaying total logins, successful logins, failed logins, error rates for each failed login, and percentages of failed logins.

Where:

Total Logins say count is 1000
Successful logins where status=200 say count=800
Failed logins is when status!=200 say count = 200

i.e., when status=401(say count = 100) or 204 (say count = 50) or 404 (say count = 50)

I first need to calculate the error rate for each failed login. So say error rate for status =401. I know the math i.e., 50/1000 where 50 is count for 401 and 100 is the total logins. But, I don't know how to use the eval command very well. Pls help!!

Also, I need to calculate the percentage of failed logins i.e., (200/1000)*100. Again, need help with the eval command. Pls help!!

Re: How do I use the eval command to calculate error rates and show them as percentages?

kmaron — Tue, 23 Oct 2018 17:30:29 GMT

eval Error_Rate = (error_count/login_count)*100
eval Percent_Failed = (failed_count/login_count)*100

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 18:33:05 GMT

Its not working. Problem is that I cant use count in eval.

For example: Here Total_logins is count(status)

so I wrote: eval Total_logins=count(status), but it returns an error. Pls help!

Re: How do I use the eval command to calculate error rates and show them as percentages?

kmaron — Tue, 23 Oct 2018 18:38:22 GMT

You need to use stats in order to get your counts. I assumed you already had those counts.

Re: How do I use the eval command to calculate error rates and show them as percentages?

Vijeta — Tue, 23 Oct 2018 19:04:11 GMT

Try this

yourquery| streamstats count(status) as Total|stats count(eval(Status!=200)) as Error by Status| eval Error_Rate = (Error/Total)*100

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 19:11:49 GMT

hmm.. I still dont understand how to get them. pls help!!

For example: how would I get total_logins?

Re: How do I use the eval command to calculate error rates and show them as percentages?

Vijeta — Tue, 23 Oct 2018 19:22:24 GMT

@moizmmz what does your event look like and what are field names for status? Each event means a login?

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 19:31:52 GMT

Here's my query:

index=akamai cp=654130 login| stats count (status)

This basically gives me the total logins.

Next, status=200 gives me successful logins and status!=200 gives me failed logins.

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 19:34:53 GMT

This doesn't work 😞 Help pls!

Re: How do I use the eval command to calculate error rates and show them as percentages?

Vijeta — Tue, 23 Oct 2018 19:52:12 GMT

Try this

 index=akamai cp=654130 login| eventstats count (status) as Total|where status!=200| stats count(status) as Error, values(Total) as Total by status| eval error_rate= Error/Total

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 20:16:08 GMT

Well... the result displays the status, total_logins and number of errors. However, I want to display only the error rate and the status

Re: How do I use the eval command to calculate error rates and show them as percentages?

kmaron — Tue, 23 Oct 2018 20:19:36 GMT

index=akamai cp=654130 login 
| eventstats count (status) as Total 
| where status!=200 
| stats count(status) as Error, values(Total) as Total by status 
| eval error_rate= Error/Total 
| fields error_rate status

Re: How do I use the eval command to calculate error rates and show them as percentages?

Vijeta — Tue, 23 Oct 2018 20:33:38 GMT

You can add |fields error_rate status at the end of query

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Tue, 23 Oct 2018 20:37:11 GMT

But there's no value for error_rate. It doesn't seem to be calculating it. I'm sorry for all the trouble 😞

Re: How do I use the eval command to calculate error rates and show them as percentages?

kmaron — Wed, 24 Oct 2018 11:57:48 GMT

Try this:

index=akamai cp=654130 login 
| eval error_ind = if(status=200,0,1) 
| stats count(status) as Total, sum(error_ind) as Errors by status 
| eval error_rate= (Errors/Total)*100
| fields error_rate status

Re: How do I use the eval command to calculate error rates and show them as percentages?

CryoHydra — Tue, 29 Sep 2020 21:44:50 GMT

Check if this helps.

your search
| stats count(eval(status="200")) as success count(eval(status!=200) as failed count(eval(status) as total_logon

| eval success_rate =(success/total_logon)*100 , failure_rate=(failed/total_logon)*100

Re: How do I use the eval command to calculate error rates and show them as percentages?

kmaron — Thu, 25 Oct 2018 16:57:48 GMT

@moizmmz did this help you at all?

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Thu, 25 Oct 2018 16:58:48 GMT

I just ran this and it worked perfectly!!'

Marry me 😛

Re: How do I use the eval command to calculate error rates and show them as percentages?

kmaron — Thu, 25 Oct 2018 17:03:12 GMT

great!! I'll convert this to an answer then you can accept it.

Re: How do I use the eval command to calculate error rates and show them as percentages?

moizmmz — Thu, 25 Oct 2018 17:23:22 GMT

Nope it gives an error 😞