topic Re: calculate percentage of a each ErrorCode field by servername in Splunk Search

calculate percentage of a each ErrorCode field by servername

indeed_2000 — Wed, 06 Oct 2021 12:54:17 GMT

how can I calculate percentage of a each ErrorCode field by servername?

here is the spl:

index="my_index"
| rex field=source "\/log\.(?<servername>\w+)."
| rex "Err\-ErrorCode\[(?<ErrorCode>\d+)"

expected output:

Servername ErrorCode Percentage

server1 404 50%

500 40%

200 10%

server2 500 50%

404 45%

200 5%

…

any idea?

Thanks

Re: calculate percentage of a each ErrorCode field by servername

ITWhisperer — Wed, 06 Oct 2021 13:29:12 GMT

index="my_index" | rex field=source "\/log\.(?<servername>\w+)." | rex "Err\-ErrorCode\[(?<ErrorCode>\d+)" | eventstats count as servercount by servername | stats count as errorcount values(servercount) as servercount by servername ErrorCode | eval Percentage=round(100*errorcount/servercount,2) | table servername ErrorCode Percentage

Re: calculate percentage of a each ErrorCode field by servername

indeed_2000 — Wed, 06 Oct 2021 14:03:26 GMT

Thank you for answer, is it possible to add count, like below?

Servername ErrorCode Percentage count

server1 404 50% 456

Re: calculate percentage of a each ErrorCode field by servername

ITWhisperer — Wed, 06 Oct 2021 14:08:35 GMT

Just add it to the table command

| table servername ErrorCode Percentage errorcount