topic Re: Plot error % as timeseries in Splunk Search

Plot error % as timeseries

sudhakar_mnsr — Sun, 27 Jun 2021 02:35:34 GMT

How to plot http error % as timeseries? (when I add _time or timeseries count Iam getting DAG: Execution exception (search cancelled)).

Query:

index=abc source=efg cdn=pqr "message.reqHost"="*xyz*" earliest=-15m latest=now

| eventstats count As Total

| eval Status=case(like(dm_status,"4%"),"HTTPERR", like(dm_status,"5%"),"HTTPERR") | stats count AS ERR_Count by Status, Total

| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)

| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE)

Re: Plot error % as timeseries

ITWhisperer — Sun, 27 Jun 2021 09:07:02 GMT

Can you share the search that doesn't work as well as the one that does?

Re: Plot error % as timeseries

sudhakar_mnsr — Sun, 27 Jun 2021 09:13:58 GMT

Thanks for looking into this. Please find the query that give error

index=abc source=efg dm_cdn=pqr "message.reqHost"=xyz earliest=-15m latest=now

| eventstats count As Total

| eval Status=case(like(dm_status,"4%"),"HTTP4XX")| stats count AS ERR_Count by Status, Total, _time

| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)

| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE) | fields _time, ERR_PERCENTAGE

| timechart span=10s count by ERR_PERCENTAGE

Re: Plot error % as timeseries

ITWhisperer — Sun, 27 Jun 2021 09:58:38 GMT

Which version of splunk are you using? Is there any useful information in the job inspector?

Re: Plot error % as timeseries

sudhakar_mnsr — Sun, 27 Jun 2021 10:41:06 GMT

Splunk Cloud (Version:8.2.2105.2).

Iam new to Splunk, if you can help me to get the information you are looking for, I can send it. However in verbose mode (events) I could not get any information.