How to write a search to display error rate over time in a dashboard?

[Alpineer8]

My first query, so far so good.
index=blah host="blah" "Error" |stats count -- gives a count of events with "error"
index=blah host="blah" |stats count -- gives a count of all events

Now I want to divide errors by events and show error rate over time in a dashboard. (I just need the query instruction, I can do the dashboard).

Thank you.

HERE IS A RAW LOG:
Time Event
11/4/14
6:46:32.987 AM

2014-11-04 07:46:32,987] [DEBUG] [some.domain.com] Client [75.133.28.247] [] [/v1/video-sessions/16037354] AccountId [8245123330006080] [thread=http-8080-110] [sessionId=5cf90c773331c5b7c9ee8d66b71a25b2] [transId=ac189325-1415333792970-160] [user=somename@domain.net]::: Connection released: [id: 6018][route: {}->http://some.domain.com:8080][total kept alive: 3; route allocated: 4 of 200; total allocated: 4 of 300]
host = somehost source = /usr/share/tomcat6/logs/somelog.log sourcetype = somesource

[ndoshi · Accepted solution]

See the timechart command in the Splunk docs.

index=blah host="blah" "Error" |timechart count

There are a few options to timechart (such as span=some bucket to do the count such as 1d or 1m or 2d)

[saikalyani9]

Hi
I want to prepare a dashboard in splunk to show the applications and the error count and sort it based on the highest error count, may i know how can i do that?

[Alpineer8]

index=blah host="blah" "Error" |timechart count

Thanks, works great.

Now I want to display errors as a % of total. I would like to add two columns. So far I have columns time, count. I want _time, error_count, total_count, error%.

[Alpineer8]

Thanks! By the way, this isn't Nipin Doshi in Bangalore by any chance? I worked with Nipindra.

[ndoshi]

No, I am not Nipin Doshi.