Alerting

Table output with Stats command

poddura
Observer

Hi All,

 

I am trying to generate a output using stats command where I want to display table like below

Hostname    FTName       Total      Error Code    Error_Count     Error_rate%

ABC                 some_ft       1000       8945                300                       30.0

I used below query which is giving me output without Error Code, if I add Error_code in stats by command it is giving total count of that error code but I want total to be total request that Ft got and out of that 8945 error code got 300 errors. How to achieve this.

 

index=xyz sourcetype=app_team   log_message.FT=some_ft|rename log_message.CODE as FTCODE|stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
| eval Error_rate=round(Errors/Total_Requests*100,2).+"%"|rename log_message.FT as FT

Hostname FT Total_Requests Errors Error_rate

ABCsome_ft259145.41

 

 

 

Labels (2)
0 Karma

gcusello
Esteemed Legend

Hi @poddura,

le me understand: do you want to execute your search only for one Error_Code (FTCODE)?

if yes, you can add a static eval at the end 

index=xyz sourcetype=app_team   log_message.FT=some_ft
|rename log_message.CODE as FTCODE
| stats count as Total_Requests ,count(eval(FTCODE=="8945")) as Errors by server_host, log_message.FT
| eval Error_rate=round(Errors/Total_Requests*100,2).+"%", FTCODE="8945"
| rename log_message.FT as FT

Yoiu can use the same method also if the error code is passed to the search by an input object.

Ciao.

Giuseppe

 

0 Karma
Get Updates on the Splunk Community!

Observability Highlights | January 2023 Newsletter

 January 2023New Product Releases Splunk Network Explorer for Infrastructure MonitoringSplunk unveils Network ...

Security Highlights | January 2023 Newsletter

January 2023 Splunk Security Essentials (SSE) 3.7.0 ReleaseThe free Splunk Security Essentials (SSE) 3.7.0 app ...

Platform Highlights | January 2023 Newsletter

 January 2023Peace on Earth and Peace of Mind With Business ResilienceAll organizations can start the new year ...