https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187013#M53875 <P>We'd like to be able to report on failure rates within our application. The metric we will use is errors per session / total # of sessions.</P> <P>We can identify when a user logs in by searching for a particular search phrase (i.e. "user X logged in") and when an error occurs ("error X occurred while processing the request for user X").</P> <P>So, total # of sessions = number of log statements that contain the text "user X logged in"<BR /> errors per session = number of log statements that contain the text "error X occurred while processing the request for user X"</P> <P>I know that I can get a count for each of the two statement types, but how do I feed that into a single report?</P> Tue, 19 Aug 2014 16:33:06 GMT sjnorman 2014-08-19T16:33:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187013#M53875 <P>We'd like to be able to report on failure rates within our application. The metric we will use is errors per session / total # of sessions.</P> <P>We can identify when a user logs in by searching for a particular search phrase (i.e. "user X logged in") and when an error occurs ("error X occurred while processing the request for user X").</P> <P>So, total # of sessions = number of log statements that contain the text "user X logged in"<BR /> errors per session = number of log statements that contain the text "error X occurred while processing the request for user X"</P> <P>I know that I can get a count for each of the two statement types, but how do I feed that into a single report?</P> Tue, 19 Aug 2014 16:33:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187013#M53875 sjnorman 2014-08-19T16:33:06Z https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187014#M53876 <P>Assuming that you have written regexes to extract both the texts and the field names that you have given are: UserLogin, Error</P> <P>Then you can write search like this</P> <PRE><CODE>Some search terms... | stats count(UserLogin) as TotalSessions, count(Error) as TotalErrors | eval FailureRate = TotalErrors/TotalSessions </CODE></PRE> Tue, 19 Aug 2014 17:39:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187014#M53876 strive 2014-08-19T17:39:39Z https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187015#M53877 <P>Wouldn't the login and error statements be considered event types, and within those types, fields would be things such as user ID, error type, etc.?</P> <P>i.e. <BR /> user X logged in = Login event type<BR /> X = user_id field</P> <P>Maybe I'm misunderstanding what Splunk considers a field?</P> Wed, 20 Aug 2014 12:07:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187015#M53877 sjnorman 2014-08-20T12:07:33Z https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187016#M53878 <P>I used your suggestion below but matched on raw search terms.</P> <P>stats count(eval(match(_raw,"<STRONG>login search terms</STRONG>"))) as TotalSessions, count(eval(match(_raw,"<STRONG><EM>error search terms</EM></STRONG>"))) as TotalErrors | eval FailureRate = TotalErrors/TotalSessions</P> Mon, 28 Sep 2020 17:22:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-report-on-failure-rates-using-count-of-errors-per/m-p/187016#M53878 sjnorman 2020-09-28T17:22:16Z