topic Re: Stats StatusCode error Rate in Splunk Search

Stats StatusCode error Rate

dpdwibedy — Wed, 05 Aug 2020 15:56:06 GMT

Hi There,

Need help to find the status code error rate where status code is >400.

I have below Query to time chart the error rate , which works fine...

index=apache_core userAgent!="nginx/*" source="*access.log*" requestURI!="/web/app*" NOT (requestURI="/api/xyz/*" OR requestURI="/api/yyy/*" AND statusCode=404) earliest=-30m latest=now | timechart span=5m limit=0 eval((count(eval(statusCode>=400)) / count()) * 100) as ErrorRate

But , to create an alert , I don't want the time chart , just the error rate in last 30 mins.

the stats count with the eval statement doesn't work.

Thanks,

Re: Stats StatusCode error Rate

richgalloway — Wed, 05 Aug 2020 16:42:06 GMT

For an alert, replace timechart with stats and eval.

index=apache_core userAgent!="nginx/*" source="*access.log*" requestURI!="/web/app*" NOT (requestURI="/api/xyz/*" OR requestURI="/api/yyy/*" AND statusCode=404) earliest=-30m latest=now | stats count(eval(statusCode>=400)) as errors, count as total | eval ErrorRate = errors * 100 / total

Re: Stats StatusCode error Rate

dpdwibedy — Wed, 05 Aug 2020 16:50:09 GMT

@richgalloway ,

Thanks! for the reply . It works , but I want only "ErrorRate" to be displayed.

Right now , it displays like this.

errors total ErrorRate 19056 679878 2.8028558064829276

Re: Stats StatusCode error Rate

richgalloway — Wed, 05 Aug 2020 17:11:25 GMT

Add | fields ErrorRate to the end of the query.

Re: Stats StatusCode error Rate

dpdwibedy — Wed, 05 Aug 2020 17:23:10 GMT

Thanks @richgalloway . Appreciated.

Regards,