Want to add error percentage column in chart view

[rahuljchavan]

I have a query where I am getting count of different http status codes like below

I want to add a error percentage column to above chart.

[thambisetty]

@rahuljchavan 

you can try below: Query will display error & success percentage both.

| rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/[a-zA-Z0-9-_/=]*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds 
| rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/imgproxy/*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds 
| eval endpoint=http_method." ".path 
| where like(path, "/info%") OR like(path, "/status%") OR like(path, "/imgproxy%") OR like(path, "/error%") OR like(path, "/rest/suite/%") 
| eval result=if(status_code>299,"error","success")
| stats count  count(eval(result="success")) as success_count count(eval(result="error")) as error_count by endpoint
| eval error_perc=(error_count/count)*100,success_perc=(success_count/count)*100
| table endpoint,error_perc,success_perc

[thambisetty]

@rahuljchavan 

can you post your query here.

[rahuljchavan]

Here is the query

| rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/[a-zA-Z0-9-_/=]*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds | rex field=_raw "(?ms)^[^\"\\n]*\"(?P<http_method>\\w+)\\s+((?P<path>/imgproxy/*).*) (?P<http_ver>[^\"]+)\"\\s+(?P<status_code>\\d+)" offset_field=_extracted_fields_bounds | eval endpoint=http_method." ".path | where like(path, "/info%") OR like(path, "/status%") OR like(path, "/imgproxy%") OR like(path, "/error%") OR like(path, "/rest/suite/%") | chart count over endpoint by status_code usenull=false

[rahuljchavan]

@thambisetty Thanks for the reply.

I am a beginner to splunk.

The columns are fetched dynamically i.e. using chart count over endpoint by status_code and might be missing some statuses runtime.

In short I want to calculate error percentage depending on these dynamically populated fields.

[thambisetty]

@rahuljchavan 

Hope you want to calculate error percentage for each endpoint.

| eval success='200' + '204'
| eval error= <add all other than above two codes here in the same fashion as above>
| eval error_perc= (error/(error+success))*100