topic Re: Httpstatuscode success/failure in Splunk Search

Httpstatuscode success/failure

lucky — Tue, 11 Jul 2023 10:58:39 GMT

Hi All,

I have 3 API's

1. in first API the status are code 200 & 403 as a success reaming all status codes are failure

2. in 2nd & 3rd API's only 200 is the success remaining all codes are failure

I need to show graph as a line chart with "Y" axis as success percentage " 0 to 100"

in X-axis need to show time

I have to use below time chart command like...

|timechart span=5m eval(if(count>10, round(mean(status),2), 100)) as percentage by countryCode useother=false limit=100

please help on this

Re: Httpstatuscode success/failure

yuanliu — Wed, 12 Jul 2023 08:16:11 GMT

You need to explain your data set in a data centric forum. Assuming that you have a field named API with values "API1", "API2", etc., and a field named status with 200, 403, etc. I think what you are looking for is

| eval success = if(API == "API1" AND status == "403" OR status == "200", 1, 0) | bin span=5m _time | stats count sum(success) as success by countryCode _time | eval percentage = round(success * 100 / count, 2) | timechart useother=false limit=100 span=5m values(percentage) as percentage by countryCode