topic Re: extract percentage of code by servername in Splunk Search

extract percentage of code by servername

indeed_2000 — Thu, 14 Oct 2021 16:08:15 GMT

Hi
i have two field "servername" "code". i need to extract percent of code by servers.

index="my-index" | table servername code

expected output:
servername code percent count
server1 404 50% 50
500 40% 40
401 10% 10
server2 404 55% 55
500 30% 30
401 15% 15

any idea?
thanks

Re: extract percentage of code by servername

efavreau — Thu, 14 Oct 2021 18:20:56 GMT

Hi @indeed_2000 ! It's often a good idea to search the community for answers before asking the question. In this case, I found exactly an answer in only one search:

https://community.splunk.com/t5/Splunk-Search/How-to-get-the-percentage-of-each-HTTP-status-code/td-p/420708

If this resolves your problem, please accept this answer.

Re: extract percentage of code by servername

indeed_2000 — Thu, 14 Oct 2021 19:01:23 GMT

the question that you mention is different that with my question.

any idea?

thanks

Re: extract percentage of code by servername

indeed_2000 — Thu, 14 Oct 2021 19:51:58 GMT

after several try finally find solution, here is the solution:

index="my-index" err* |

| fields code, servername
| stats count(code) as totalCount by servername, code
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerServer by servername
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerServer=round((totalCount/_totalPerServer)*100,2)
| stats list(code) as code list(precentagePerServer) as percentageTotal list(totalCount) by servername
| sort - totalCount

Re: extract percentage of code by servername

efavreau — Tue, 19 Oct 2021 21:44:09 GMT

@indeed_2000It looks like the solution you posted and accepted uses the code from the page I linked to. Glad it helped you. It looks like you've found that lines of SPL code may be useful for multiple use cases.
If the pointer I provided was helpful, a karma thumbs up is appreciated.
Happy Splunking!