topic Calculate error percentage of HTTPStatus in Splunk Search

Calculate error percentage of HTTPStatus

kris1733 — Tue, 10 Oct 2023 17:59:21 GMT

index=sample(Consumer="prod") ServiceName="product.services.prd.*"
| stats count(eval(HTTPStatus >= 400 AND HTTPStatus < 500)) AS 'fourxxErrors', count(eval(HTTPStatus >= 500 AND HTTPStatus < 600)) AS 'fivexxErrors', count AS 'TotalRequests'
| eval 'fourxxPercentage' = if('TotalRequests' > 0, ('fourxxErrors' / 'TotalRequests') * 100, 0), 'fivexxPercentage' = if('TotalRequests' > 0, ('fivexxErrors' / 'TotalRequests') * 100, 0)
| table "fourxxPercentage", "fivexxPercentage"

The result is showing as 0 for both fields inside the table "fourxxPercentage", "fivexxPercentage". Actually, fourxxErrors and fivexxErrors count are greater than 0. Is that because it's not showing the decimal values?

Re: Calculate error percentage of HTTPStatus

_JP — Tue, 10 Oct 2023 18:47:27 GMT

Remove all the ticks/quotes from the field names in your SPL - for what you are doing they aren't necessary. I only quote my field names if they have any negative space characters. Once I did that I was able to "fake" your search in my environment and get results:

index=_internal status=* | rename status AS HTTPStatus | stats count(eval(HTTPStatus >= 400 AND HTTPStatus < 500)) AS fourxxErrors, count(eval(HTTPStatus >= 500 AND HTTPStatus < 600)) AS fivexxErrors, count AS TotalRequests | eval fourxxPercentage = if(TotalRequests > 0, (fourxxErrors / TotalRequests) * 100, 0), fivexxPercentage = if(TotalRequests > 0, (fivexxErrors / TotalRequests) * 100, 0) | table fourxxPercentage, fivexxPercentage

Also, I just added this at the beginning to turn misc data in _internal into events that "look" like yours for this example purpose:

index=_internal status=* | rename status AS HTTPStatus

Re: Calculate error percentage of HTTPStatus

kris1733 — Tue, 10 Oct 2023 18:57:24 GMT

@_JP Hi, the query which you shared me works same like the one which I shared. The percentage values are showing 0. Is it because we need to add decimal values after 0. I tried adding

(fourxxErrors / TotalRequests) * 100, 2)

instead of

(fourxxErrors / TotalRequests) * 100, 0)

But no use. Do you have any other idea?

Re: Calculate error percentage of HTTPStatus

_JP — Tue, 10 Oct 2023 19:03:59 GMT

I don't have any 500's in my _internal index (this is not a flex...just a fresh install before I have had a chance to break anything). So this is what my results look like:

Maybe for the timerange you don't have any 5xx errors? If I flub the query a little more in my environment and change the boolean criteria a bit in the SPL to be >=300<400 (see highlighted section) then it works correctly for me:

Re: Calculate error percentage of HTTPStatus

yuanliu — Tue, 10 Oct 2023 23:10:41 GMT

@_JP is correct that single quotes have special meaning in SPL. Have you tested

Can you share sample output from this?