Splunk Enterprise

How do you count the number of occurrences and compare with the total?

Explorer

I have some call logs that I want to sort.

I have fields for remotealias and disconnectreason. There are many different disconnect reasons, but I want to see how many calls have disconnectreason="Dialog has failed" as compared to the total, and then sort it by remotealias; then, we could see how many times a user has had this reason code compared to the number of times they have called.

host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason) by remote_alias

If i run this command, then I'll see results in a list like this:

alt text

michal here has 9 events, where 1 of them is "dialog has failed". Is there any way to get this all in two columns? One for the total and the other for number of "dialog has failed" occurrences pr remote alias ?

Tags (1)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi,

Try this

host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason), count as Total_Count, sum(eval(if(disconnect_reason="dialog has failed",1,0))) as sum_dialog_failed by remote_alias

View solution in original post

Motivator

This should give you the desired results:

host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason) as reasons count(eval(disconnect_reason=="Dialog has failed")) as failed_diag count(*) as total by remote_alias | eval perc_failed=(failed_diag/total*100) 

If you want to hide one or more of the calculated fields you can always exclude them with fields -fieldname

0 Karma

SplunkTrust
SplunkTrust

Hi,

Try this

host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason), count as Total_Count, sum(eval(if(disconnect_reason="dialog has failed",1,0))) as sum_dialog_failed by remote_alias

View solution in original post

Explorer

Awe heck, that was fast. And it works perfectly as well. Thank you !

0 Karma

SplunkTrust
SplunkTrust

Welcome 🙂

0 Karma