topic Re: How to calculate Percentage of particular events out of total events. in Splunk Search

How to calculate Percentage of particular events out of total events.

mrigank517 — Wed, 30 Sep 2020 00:32:17 GMT

I want to find the percent of events with the key word error out of all the events recorded during a time window
I have the following query in place but the result generated is 0.0000%

index=XXX "*" | stats count AS "Total", count(eval(eventMessage=="error")) AS Failure|eval Failurerate=(Failure/Total)*100|table Failurerate

Re: How to calculate Percentage of particular events out of total events.

harsmarvania57 — Fri, 17 May 2019 12:18:01 GMT

Hi,

Please try below query

index=XXX "*" | stats count AS "Total", sum(eval(if(eventMessage="error",1,0))) AS Failure|eval Failurerate=(Failure/Total)*100|table Failurerate

Re: How to calculate Percentage of particular events out of total events.

p_gurav — Fri, 17 May 2019 12:25:14 GMT

Try this:

index=XXX  | stats count AS "Total", sum(eval(if(eventMessage=="error", 1, 0))) AS Failure|eval Failurerate=(Failure/Total)*100|table Failurerate

Re: How to calculate Percentage of particular events out of total events.

mrigank517 — Fri, 17 May 2019 12:26:00 GMT

The query runs fine but the result generated is 0.
Ideally it should be above 0

Re: How to calculate Percentage of particular events out of total events.

harsmarvania57 — Fri, 17 May 2019 12:28:59 GMT

It looks like you don't have field extracted or space or any other character is present in eventMessage field

Can you please run below query and please let us know are you getting any output ?

index="xxx" eventMessage="error"

Re: How to calculate Percentage of particular events out of total events.

mrigank517 — Fri, 17 May 2019 12:32:17 GMT

Yeah you sensed it right this returns 0 result. But when searched with the following query the results are populated.

index="xxx" error

Re: How to calculate Percentage of particular events out of total events.

harsmarvania57 — Fri, 17 May 2019 12:34:23 GMT

Yes because you are searching error word in raw data, however query which I have provided specifically search error word in eventMessage field, so you need to fix your field extraction first then query which I have provided will work.

Re: How to calculate Percentage of particular events out of total events.

mrigank517 — Fri, 17 May 2019 12:35:00 GMT

No luck, as discussed below eventMessage=="error" is not returning any results.

Re: How to calculate Percentage of particular events out of total events.

mrigank517 — Fri, 17 May 2019 12:38:33 GMT

Any hints on how to get the field extracted or to run this through raw data?

Re: How to calculate Percentage of particular events out of total events.

harsmarvania57 — Fri, 17 May 2019 12:40:04 GMT

If you can provide some sample raw data (please mask sensitive data) then we can write regular expression to extract data in field and then use that field in stats.

Re: How to calculate Percentage of particular events out of total events.

mrigank517 — Fri, 17 May 2019 14:23:12 GMT

My karma wont allow me to attach the file.

This is the next best i could do with raw data.

40.22% 6544 timestamp ERROR Application error.
21.84% 7072 timestamp ERROR [Brandify] GetNearestRestaurants: The operation has timed out
7.07% 3380 timestamp ERROR Cannot create tracker.
6.79% Message: Error while rendering view: 'xxx.cshtml' (model: 'Sitecore.Mvc.Presentation.RenderingModel, Sitecore.Mvc').
2.85% 4308 timestamp ERROR CreateAccount failed. Time elapsed: 00:00:00.042, ErrorCode: 110, ErrorMessage: Duplicate email address
1.73% 3896 timestamp ERROR Cannot finish Analytics page tracking
1.34% 3752 timestamp ERROR MediaRequestProtection: An invalid/missing hash value was encountered. The expected hash value: 8A206C19591658B84F4EDE5F513B9A007EF9056A. Media URL: /-/media/header/XXXXXXXXXXX.ashx?h=339&w=1472&la=en&hash=%2527%2520%25278%2527%2520%2527A206C19591658B84F4EDE5F513B9A007EF9056A%2527%2520%2527%2527%2520%2527, Referring URL:
0.57% 1404 timestamp ERROR System.OperationCanceledException: The operation was canceled.
0.36% Message: Error converting value {null} to type 'System.Single'. Path '[0].latitude', line 1, position 34.
0.22% Message: The remote server returned an error: (504) Gateway Timeout.

Re: How to calculate Percentage of particular events out of total events.

somesoni2 — Fri, 17 May 2019 15:57:31 GMT

Give these a try

index=XXX "*" | stats count AS "Total", count(eval(searchmatch("error"),1,0)) AS Failure|eval Failurerate=(Failure/Total)*100|table Failurerate

index=XXX "*" | stats count AS "Total", count(eval(match(eventMessage,"error"),1,0)) AS Failure|eval Failurerate=(Failure/Total)*100|table Failurerate