Archive
Highlighted

How do I query the percentage of unique sessions seeing errors?

New Member

I'm trying to come up with a query that's a percentage of users (via session ids) experiencing errors. i can find the number of unique sessions with index="my-index" | stats dc(session_id) and the number of unique users seeing errors with index="my-index" category="error" | stats dc(session_id), but I can't seem to bring these two numbers together and make a ratio. Any recommendations?

Tags (2)
0 Karma
Highlighted

Re: How do I query the percentage of unique sessions seeing errors?

Motivator

Hello @cochang,

Try using the appendcols command:

index="my-index" | stats dc(session_id) as total_sessions
| appendcols [search index="my-index" category="error" | stats dc(session_id) as error_sessions]
| eval percentage=round(error_sessions/total_sessions*100,2)."%"

View solution in original post

0 Karma
Speak Up for Splunk Careers!

We want to better understand the impact Splunk experience and expertise has has on individuals' careers, and help highlight the growing demand for Splunk skills.