This widget could not be displayed.
  • ">Apps & Add-ons
  • Alerting

    Table output with Stats command

    poddura
    Observer

    Hi All,

     

    I am trying to generate a output using stats command where I want to display table like below

    Hostname    FTName       Total      Error Code    Error_Count     Error_rate%

    ABC                 some_ft       1000       8945                300                       30.0

    I used below query which is giving me output without Error Code, if I add Error_code in stats by command it is giving total count of that error code but I want total to be total request that Ft got and out of that 8945 error code got 300 errors. How to achieve this.

     

    index=xyz sourcetype=app_team   log_message.FT=some_ft|rename log_message.CODE as FTCODE|stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
    | eval Error_rate=round(Errors/Total_Requests*100,2).+"%"|rename log_message.FT as FT

    Hostname FT Total_Requests Errors Error_rate

    ABCsome_ft259145.41

     

     

     

    Labels (2)
    0 Karma

    gcusello
    SplunkTrust
    SplunkTrust

    Hi @poddura,

    le me understand: do you want to execute your search only for one Error_Code (FTCODE)?

    if yes, you can add a static eval at the end 

    index=xyz sourcetype=app_team   log_message.FT=some_ft
    |rename log_message.CODE as FTCODE
    | stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
    | eval Error_rate=round(Errors/Total_Requests*100,2).+"%", FTCODE="8945"
    | rename log_message.FT as FT

    Yoiu can use the same method also if the error code is passed to the search by an input object.

    Ciao.

    Giuseppe

     

    0 Karma
    Get Updates on the Splunk Community!

    Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

    WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

    Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

    Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

    Enterprise Security Content Update (ESCU) | New Releases

    In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...