Splunk Enterprise

percentage of one field event over other

New Member

I have two query

1: sourcetype=A error=499
2: sourcetype=A X=*

2nd query is almost equal to total transactions.

I would like to make timechart of % of error count on X events.

Basically I want to make timechart that will tell if error code increase is because of volume increase etc,

0 Karma

Ultra Champion
 index=foo sourcetype=A (error="*"  X="*") 
| eval error=case(error="499",1,true(),0)
| timechart count as total sum(error) as error
| eval perc=round(error / total * 100,2)
0 Karma

Esteemed Legend

Like this:

index="YouShouldAlwaysSpecifyAnIndex" AND sourcetype="A" AND (error="499" OR X="*")
| timechart count(eval(error="499")) AS error499count BY X
0 Karma


This should get you started.

index=foo sourcetype=A (error=499 OR X=*) 
| bin span=1d _time
| stats count(eval(isnotnull(X)) as Total, count(eval(error=499)) as Error by _time
| eval Pct = (Error * 100) / Total
| timechart span=1d max(Pct)
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

Security Highlights: September 2022 Newsletter

 September 2022 The Splunk App for Fraud Analytics (SFA) is now Splunk SupportedUse your existing Splunk ...

Platform Highlights | September 2022 Newsletter

 September 2022 What’s New in 9.0 and How to UpgradeGet a walk through of what is new Splunk Enterprise 9.0 ...

Observability Highlights | September 2022 Newsletter

 September 2022 Splunk Observability SuiteAccess to "Classic" SignalFx Interface Will be Removed on Sept 30, ...