This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the same dataset that you will have already downloaded and ingested into Splunk. If not, please go to the Tutorial and complete it (or at least download and ingest the dataset).
This is the eighth blog in the series, and builds on the dashboard created in the previous blogs.
Another way to look at the success rates (or failure rates for that matter), is to compare the hourly rate against the maximum and minimum rate for the same hour of the day over the last few days.This screen image shows the hourly success rate compared to the min and max from the last 7 days.
Starting with the same search you started with, add a new panel to the dashboard.
sourcetype=access_combined_wcookie
| timechart span=1h count by status
| addtotals row=t fieldname=_total
| where _total > 0
| eval success=round(100*'200'/_total,2)
| table _time success
This screen image shows some of the hourly success rates from the events access log.
Next step is to go on to part 9 where you can compare the last 24 hours with the same hours in previous days.
You must be a registered user to add a comment. If you've already registered, sign in. Otherwise, register and sign in.