How do I calculate the error rate using 2 fields?

[djain]

Hey Splunkers,

I'm in a bit of a tricky situation. I have to calculate the error rate using 2 fields. The numerator has every receiver that has an error and the denominator is the total number of receivers.

So, I want to filter the numerators with the error code and eventually find out the error rate by error code. And do that in a way where total receivers for that day remain constant.

Here is what I tried:

index = abc (sourcetype=123 OR sourcetype=456)
| fields receiverId.string receiverId errorCode.string
| rename receiverId.string AS  Receiver
| rename errorCode.string AS errorCode
| eventstats dc(Receiver) AS Receivers_with_errors BY errorCode
| eventstats dc(receiverId) AS Total_Receivers
| fields Receivers_with_errors errorCode Total_Receivers
| eval ErrorRate= round(((Receivers_with_errors/Total_Receivers)*100),2)
| timechart avg(ErrorRate) by errorCode limit=15 span=1d

I thought the timechart command would help me divide the Total receivers while the Receivers_with_errors would be first sorted by error codes and then, because of the timechart, through time.

But, is there a better way to this?

Also, I am getting results in verbose mode, but not in fast mode. Why could that be? The data set is huge so I can't use verbose.

[mstjohn_splunk]

hi @djain

Did the one of the answers below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

[woodcock]

Try this:

index = abc (sourcetype=123 OR sourcetype=456)
| fields receiverId.string receiverId errorCode.string
| rename receiverId.string AS  Receiver
| rename errorCode.string AS errorCode
| bucket _time span=1d
| eventstats dc(Receiver) AS Receivers_with_errors BY errorCode _time
| eventstats dc(receiverId) AS Total_Receivers
| timechart avg(eval(round(((Receivers_with_errors/Total_Receivers)*100),2))) by errorCode limit=15 span=1d

[baldwintm]

The only thing that I can think of for why it isn't working in fast mode is that the fields that you need aren't being extracted. Is this JSON data?
You might need to manually extract the data in the search (maybe using the |rex command)

As a side-note, for the timechart command, span=1d should go before the avg(ErrorRate) part.