Archive
Highlighted

How do I calculate the error rate using 2 fields?

Path Finder

Hey Splunkers,

I'm in a bit of a tricky situation. I have to calculate the error rate using 2 fields. The numerator has every receiver that has an error and the denominator is the total number of receivers.

So, I want to filter the numerators with the error code and eventually find out the error rate by error code. And do that in a way where total receivers for that day remain constant.

Here is what I tried:

index = abc (sourcetype=123 OR sourcetype=456)
| fields receiverId.string receiverId errorCode.string
| rename receiverId.string AS  Receiver
| rename errorCode.string AS errorCode
| eventstats dc(Receiver) AS Receivers_with_errors BY errorCode
| eventstats dc(receiverId) AS Total_Receivers
| fields Receivers_with_errors errorCode Total_Receivers
| eval ErrorRate= round(((Receivers_with_errors/Total_Receivers)*100),2)
| timechart avg(ErrorRate) by errorCode limit=15 span=1d

I thought the timechart command would help me divide the Total receivers while the Receiverswitherrors would be first sorted by error codes and then, because of the timechart, through time.

But, is there a better way to this?

Also, I am getting results in verbose mode, but not in fast mode. Why could that be? The data set is huge so I can't use verbose.

0 Karma
Highlighted

Re: How do I calculate the error rate using 2 fields?

Path Finder

The only thing that I can think of for why it isn't working in fast mode is that the fields that you need aren't being extracted. Is this JSON data?
You might need to manually extract the data in the search (maybe using the |rex command)

As a side-note, for the timechart command, span=1d should go before the avg(ErrorRate) part.

0 Karma
Highlighted

Re: How do I calculate the error rate using 2 fields?

Esteemed Legend

Try this:

index = abc (sourcetype=123 OR sourcetype=456)
| fields receiverId.string receiverId errorCode.string
| rename receiverId.string AS  Receiver
| rename errorCode.string AS errorCode
| bucket _time span=1d
| eventstats dc(Receiver) AS Receivers_with_errors BY errorCode _time
| eventstats dc(receiverId) AS Total_Receivers
| timechart avg(eval(round(((Receivers_with_errors/Total_Receivers)*100),2))) by errorCode limit=15 span=1d
0 Karma
Highlighted

Re: How do I calculate the error rate using 2 fields?

Splunk Employee
Splunk Employee

hi @djain

Did the one of the answers below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma