topic Calculate percentage by eval status in Splunk Search

Calculate percentage by eval status

Noah — Tue, 27 Jul 2021 02:18:19 GMT

Hi Everyone!

Could you please help, how to calculate (UP percentage) by app_service

I have the query as:

eval status=if(success="successful .Statuscode:200", "UP", "DOWN"
| table app_service status

I get the table I need, but I have difficulty calculating the "UP" percentage and total percentage per app_service from the above query

Thank you

Re: Calculate percentage by eval status

venkatasri — Tue, 27 Jul 2021 04:23:02 GMT

Hi @Noah

Can you try this?

| makeresults | eval success="successful .Statuscode:200" , app_service="jobber" | eval status=if(success="successful .Statuscode:200", "UP", "DOWN") | stats count, count(eval(status="UP")) as up_count by app_service | eval perc= round((up_count/count) * 100,4) | table count up_count app_service perc

An upvote would be appreciated and Accept solution if this reply helps!

Re: Calculate percentage by eval status

Noah — Tue, 27 Jul 2021 13:30:44 GMT

Thank you @venkatasri Venkatasri! This definitely helped with some modifications. Much appreciated!