topic Re: eval percentage issue in Splunk Search

eval percentage issue

kelambert — Fri, 03 Jan 2014 18:54:24 GMT

I am trying to create an error percent tracker, but I cant get the eval command to generate a number. I have tried several search strings, these two seem to be the closest to success.

index="java" host="*tkn*" proxy\/listing | stats count as total | append [search index="java" host="*tkn*" proxy\/listing eventtype="java_exception*" OR eventtype="nix_errors" | stats count as error] | eval error_percentage=100*round(error/success,4) | fields error_percentage,error,total | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0

index="java" host="*tkn*" proxy\/listing | stats count as total | search eventtype="java_exception*" OR eventtype="nix_errors" | stats count as error | eval error_percentage=100*round(error/success,4) | fields error_percentage | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0

Re: eval percentage issue

somesoni2 — Fri, 03 Jan 2014 20:23:43 GMT

Try following

index="java" host="tkn" proxy/listing | eval hasError=if(eventtype="java_exception" OR eventtype="nix_errors","yes","no") | stats count(eval(hasError="yes")) as error, count as total | eval error_percentage=round(error*100/total,4) | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0

Re: eval percentage issue

martin_mueller — Fri, 03 Jan 2014 20:30:48 GMT

I'm guessing you want to know what percentage of events from your base search have one of those two eventtypes?

Try something like this:

base search | stats count as total count(eval(match(eventtype, "^java_exception") OR eventtype="nix_errors")) as errors | eval error_percentage=100*round(errors/total,4)

If you like, you can pull the definition of what constitutes an error out of the stats, to get something like this:

base search | eval error=if(match(eventtype, "^java_exception") OR eventtype="nix_errors",1,0) | stats count as total sum(error) as errors | eval error_percentage=100*round(errors/total,4)

Re: eval percentage issue

linu1988 — Fri, 03 Jan 2014 20:32:22 GMT

How do you get the value of success? With a append statement u wont be able to combine it to single event right?

Re: eval percentage issue

kelambert — Fri, 03 Jan 2014 20:46:31 GMT

Success was a typo from the opposite query, was suppose to be total. The below answers all worked perfectly, thank you for the help