https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227791#M67278 <P>Sorry, problem needs to be in quotes. <CODE>count(eval(tag="problem"))</CODE></P> Fri, 24 Jun 2016 23:39:54 GMT sundareshr 2016-06-24T23:39:54Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227788#M67275 <P>I would like to get a ratio of errors by app_pool, and then compare it to 5, 10, 1hr ago? </P> <PRE><CODE>tag=java | stats count as "Events" by app_pool | appendcols [search tag=java tag=problem | stats count as "Problems" by app_pool] </CODE></PRE> <P>I am thinking a running summary index counting errors and counting events by app_pool, then a search which compares things after the fact? Is there a better way to do this? </P> Fri, 24 Jun 2016 22:41:59 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227788#M67275 daniel333 2016-06-24T22:41:59Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227789#M67276 <P>Try this</P> <PRE><CODE>tag=java earliest=@d | timechart span=1h count as Events count(eval(tag=problem)) as Problems | eval ratio=round(Problems/Events, 2) </CODE></PRE> Fri, 24 Jun 2016 22:58:23 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227789#M67276 sundareshr 2016-06-24T22:58:23Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227790#M67277 <P>Hmm, the evals there don't seem to work. Returning nothing. </P> Fri, 24 Jun 2016 23:18:32 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227790#M67277 daniel333 2016-06-24T23:18:32Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227791#M67278 <P>Sorry, problem needs to be in quotes. <CODE>count(eval(tag="problem"))</CODE></P> Fri, 24 Jun 2016 23:39:54 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227791#M67278 sundareshr 2016-06-24T23:39:54Z https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227792#M67279 <P>You need the <CODE>timewrap</CODE> app:</P> <P><A href="https://splunkbase.splunk.com/app/1645/">https://splunkbase.splunk.com/app/1645/</A></P> Sat, 25 Jun 2016 03:01:27 GMT https://community.splunk.com/t5/Splunk-Search/How-can-I-compare-the-ratio-of-errors-to-10-minutes-ago-for-all/m-p/227792#M67279 woodcock 2016-06-25T03:01:27Z