topic calculating field percentages before stats command in Splunk Search

calculating field percentages before stats command

amerineni — Sun, 19 Jul 2020 19:35:13 GMT

index= base search | stats count, avg(ElapsedTime) as duration, by requestName, LogType, errorMessage, HttpStatus, isValidError

is there anyway i can calculate the success percent of each requestName field based on HttpStatus values(<299 success and >299 failure) before executing stats command and then include that in the result table?

Appreciate any help.

Re: calculating field percentages before stats command

isoutamo — Sun, 19 Jul 2020 20:50:03 GMT

You could try this:

index=base search | eval h_ok=if(HttpStatus < 299, 1, 0) | eval h_nok=if(HttpStatus > 299, 1, 0) | stats sum(h_ok) as h_ok, sum(h_nok) as h_nok, count, avg(ElapsedTime) as duration, by requestName, LogType, errorMessage, HttpStatus, isValidError | eval h_per_ok = round(h_ok/(h_ok + h_nok),2)*100, h_per_nok = round(h_nok/(h_ok+h_nok),2) | table h_per_ok, h_per_nok, requestName, ....

Re: calculating field percentages before stats command

amerineni — Sun, 19 Jul 2020 21:16:58 GMT

thanks for the quick response.

My data looks like this

requestName1 logType1 errorMessage1

requestName1 logType1 errorMessage2

the query you suggested returns different success percent for the above two combinations. However i want to populate a column with total success percent for "request1" not individual combinations success percents. Hope explained what i need correctly.

I'm doing a sub query to calculate to percentages and then joining now. Wanted to know if there is a better way. Thanks.

Re: calculating field percentages before stats command

anmolpatel — Mon, 20 Jul 2020 06:00:56 GMT

@amerineni this should provide the guidance on what you need

| makeresults | eval _raw="HttpStatus, isValidError 200, false 200, false 201, false 305, true 202, false 400, true 500, true" | multikv forceheader=1 | rename COMMENT AS "CHECK THE CODE FROM HERE ON" | eval result = if(HttpStatus < 299, 1, 0) | eventstats count as TotalSuccessFailure by result | eventstats count as TotalEvents | eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1) | rename COMMENT AS "CHECK THE CODE ABOVE HERE" | fields HttpStatus result TotalSuccessFailure TotalEvents percent

you can than take it further and just get the score by using stats

| stats values(percent) by result