topic Re: % failures for each day during the time range selected in Splunk Search

% failures for each day during the time range selected

VS0909 — Wed, 21 Jul 2021 09:07:39 GMT

Need help with a Splunk query to display % failures for each day during the time range selected

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc" "searchTermForA1"

A2= Total number of events returned by the below query:

index="xyz" "searchTermForA2"

Expected Output:

-------Date-------|--------A1-------------|------A2----------|-----% failures-------

Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul.

Please help with the query.

Thanks!

Re: % failures for each day during the time range selected

ITWhisperer — Wed, 21 Jul 2021 09:54:33 GMT

(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2") | bin _time span=1d | stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2 by _time | eval failures=100*A1/A2

Re: % failures for each day during the time range selected

VS0909 — Tue, 27 Jul 2021 10:31:43 GMT

@ITWhisperer Thanks for the reply!

I also have a scenario where I need to find % failure for each day during the time range selected, for same index but different search term

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc" "searchTermForA1"

A2= Total number of events returned by the below query:

index="abc" "searchTermForA2"

Please help.

Re: % failures for each day during the time range selected

ITWhisperer — Tue, 27 Jul 2021 10:57:31 GMT

It will depend on what "searchTermForA1" and "searchTermForA2" actually are and possibly what your events actually look like

Re: % failures for each day during the time range selected

VS0909 — Tue, 27 Jul 2021 11:09:55 GMT

@ITWhisperer

searchTermForA1 = "A1_API_Failed"

searchTermForA2="TESTSTRING" "https://aaa.com/v1/?bbb"

Re: % failures for each day during the time range selected

ITWhisperer — Tue, 27 Jul 2021 11:24:17 GMT