topic Re: How to edit my stats count search to chart a percentage trend over time? in Splunk Search

How to edit my stats count search to chart a percentage trend over time?

sidekix24 — Fri, 19 Feb 2016 19:38:10 GMT

Hi,

I have the search below that displays an availability percentage for me, but now I'm looking to time chart that percentage to show a trend of the availability percentage over time. I'm thinking that the issue I'm having is that once you use count, that does a count over the selected time so it wraps up everything into that one percentage.

| stats count(eval(Login_Status)) AS Total count(eval(Login_Status=302 AND Recruiter_Status=200 AND QuickSearch_Status=200)) AS Success | eval Division=Success/Total | eval Percent=round ((Division)*100,2) | eval Final=Percent + "%" | table Percent

Anyone have any suggestions or ideas to try?

Thanks

Re: How to edit my stats count search to chart a percentage trend over time?

vasildavid — Fri, 19 Feb 2016 21:33:55 GMT

Use buckets and break your stats down by _time.

| bucket _time span=5m 
  | stats count(eval(Login_Status)) AS Total, count(eval(Login_Status=302 AND Recruiter_Status=200 AND QuickSearch_Status=200)) AS Success by _time 
  | eval Division=Success/Total 
  | eval Percent=round ((Division)*100,2) 
  | eval Final=Percent + "%" 
  | table _time, Percent

Re: How to edit my stats count search to chart a percentage trend over time?

sidekix24 — Mon, 22 Feb 2016 19:34:41 GMT

Thanks vasildavid!!! That did the trick