topic Re: format my successRate query into a week over week comparison in Splunk Search

format my successRate query into a week over week comparison

billycn20 — Thu, 06 May 2021 19:45:41 GMT

i have a working query which is monitoring the success rate based off a value called app_id. i want to extend the current query i have and also show the success rate for each app_id but broken down by currentWeek, lastWeek, 2weeksago success rate percentage.

My current query is:
index=jj3 "TRANSACTIONA" OR "TRANSACTIONB" | rex field=log "\"app_id\": \W(?<app_id>\w+)\W" | rex field=log "\"event_name\": \W(?<event_name>[a-zA-Z-|_|:]+)\W" | eval firstTransaction=if(event_name=="TRANSACTIONA", 1, 0) | eval secondTransaction=if(event_name=="TRANSACTIONB", 1, 0) | stats sum(firstTransaction) as TotalfirstTransaction sum(secondTransaction) as TotalsecondTransaction by app_id | dedup app_id | eval successRate=round(TotalsecondTransaction/TotalfirstTransaction*100, 1)."%" | fillnull successRate | sort - successRate | search NOT successRate=0

Re: format my successRate query into a week over week comparison

sravankaripe — Thu, 06 May 2021 19:52:36 GMT

try with this at the end
select timerange last 30 days like that

--- ---- ---- | bin _time span=1w | stats count

Re: format my successRate query into a week over week comparison

billycn20 — Thu, 06 May 2021 19:59:29 GMT

no, that doesn't seem to provide any desirable results.

Re: format my successRate query into a week over week comparison

sravankaripe — Thu, 06 May 2021 20:01:50 GMT

remove dedup after stats you may get some results

Re: format my successRate query into a week over week comparison

billycn20 — Thu, 06 May 2021 20:11:46 GMT

using that suggestion as well, doesn't provide any change in results. my stats actually still looks identical to my original query:

here is the updated query as per your suggestions:

index=jj3 "TRANSACTIONA" OR "TRANSACTIONB" | rex field=log "\"app_id\": \W(?<app_id>\w+)\W" | rex field=log "\"event_name\": \W(?<event_name>[a-zA-Z-|_|:]+)\W" | eval firstTransaction=if(event_name=="TRANSACTIONA", 1, 0) | eval secondTransaction=if(event_name=="TRANSACTIONB", 1, 0) | bin _time span=2w | stats sum(firstTransaction) as TotalfirstTransaction sum(secondTransaction) as TotalsecondTransaction by app_id | eval successRate=round(TotalsecondTransaction/TotalfirstTransaction*100, 1)."%" | fillnull successRate | sort - successRate | search NOT successRate=0