Splunk Dev

How do I calculate the error rate using 2 fields?

djain
Path Finder

Hey Splunkers,

I'm in a bit of a tricky situation. I have to calculate the error rate using 2 fields. The numerator has every receiver that has an error and the denominator is the total number of receivers.

So, I want to filter the numerators with the error code and eventually find out the error rate by error code. And do that in a way where total receivers for that day remain constant.

Here is what I tried:

index = abc (sourcetype=123 OR sourcetype=456)
| fields receiverId.string receiverId errorCode.string
| rename receiverId.string AS  Receiver
| rename errorCode.string AS errorCode
| eventstats dc(Receiver) AS Receivers_with_errors BY errorCode
| eventstats dc(receiverId) AS Total_Receivers
| fields Receivers_with_errors errorCode Total_Receivers
| eval ErrorRate= round(((Receivers_with_errors/Total_Receivers)*100),2)
| timechart avg(ErrorRate) by errorCode limit=15 span=1d

I thought the timechart command would help me divide the Total receivers while the Receivers_with_errors would be first sorted by error codes and then, because of the timechart, through time.

But, is there a better way to this?

Also, I am getting results in verbose mode, but not in fast mode. Why could that be? The data set is huge so I can't use verbose.

0 Karma

mstjohn_splunk
Splunk Employee
Splunk Employee

hi @djain

Did the one of the answers below solve your problem? If so, please resolve this post by approving it! If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!

0 Karma

woodcock
Esteemed Legend

Try this:

index = abc (sourcetype=123 OR sourcetype=456)
| fields receiverId.string receiverId errorCode.string
| rename receiverId.string AS  Receiver
| rename errorCode.string AS errorCode
| bucket _time span=1d
| eventstats dc(Receiver) AS Receivers_with_errors BY errorCode _time
| eventstats dc(receiverId) AS Total_Receivers
| timechart avg(eval(round(((Receivers_with_errors/Total_Receivers)*100),2))) by errorCode limit=15 span=1d
0 Karma

baldwintm
Path Finder

The only thing that I can think of for why it isn't working in fast mode is that the fields that you need aren't being extracted. Is this JSON data?
You might need to manually extract the data in the search (maybe using the |rex command)

As a side-note, for the timechart command, span=1d should go before the avg(ErrorRate) part.

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...