Evaluating a custom formula in Splunk

[vijaybhat85]

In our application we log the response statuses in Splunk for all requests hitting our endpoint, something along the lines of "response status for the request was 200 OK". In case of a failure the response status changes to "response status for the request was 500 Internal Error" , "response status for the request was 404 Not Found", etc. I want to compute a success rate for the application. Basically its a ratio of all "200 OK" to the sum total of all requests logged, something like (http_200 / http_all) * 100. Any ideas on the best way forward for this. I tried using eval but am stuck in terms of evaluating two different result sets and the subsequent ratio computation.

[kmorris_splunk]

Try something like this:

sourcetype=access_combined 
| stats count(eval(action="remove")) as remove_count count as all_count 
| eval remove_ratio_%=round(((remove_count/all_count)*100),0)