Alerting

Table output with Stats command

poddura
Observer

Hi All,

 

I am trying to generate a output using stats command where I want to display table like below

Hostname    FTName       Total      Error Code    Error_Count     Error_rate%

ABC                 some_ft       1000       8945                300                       30.0

I used below query which is giving me output without Error Code, if I add Error_code in stats by command it is giving total count of that error code but I want total to be total request that Ft got and out of that 8945 error code got 300 errors. How to achieve this.

 

index=xyz sourcetype=app_team   log_message.FT=some_ft|rename log_message.CODE as FTCODE|stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
| eval Error_rate=round(Errors/Total_Requests*100,2).+"%"|rename log_message.FT as FT

Hostname FT Total_Requests Errors Error_rate

ABCsome_ft259145.41

 

 

 

Labels (1)
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @poddura,

le me understand: do you want to execute your search only for one Error_Code (FTCODE)?

if yes, you can add a static eval at the end 

index=xyz sourcetype=app_team   log_message.FT=some_ft
|rename log_message.CODE as FTCODE
| stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
| eval Error_rate=round(Errors/Total_Requests*100,2).+"%", FTCODE="8945"
| rename log_message.FT as FT

Yoiu can use the same method also if the error code is passed to the search by an input object.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...