Splunk ITSI

Getting percentages from in iTSI in a base search

brent_weaver
Builder

I have events that have http error codes in them. I would like to be able to get a percentage of 500 errors for all the events. I have this as my base search:

index=firehose sourcetype="cf_logs_syslog" source_type=RTR 
| eval 5xx_code=if(responseCode>=500 AND responseCode<=599, 1, 0)
| eval 4xx_code=if(responseCode>=400 AND responseCode<=499, 1, 0)
| eval 2xx_code=if(responseCode>=200 AND responseCode<=399, 1, 0)

If i were in core splunk I could conjure up the SPL to do this, but I struggle with iTSI as a base search. I would ultimately like to have percentages of all 200-399, 400-499, and 500-599 error codes. I guess you could say that the fact that I cannot use the eval function is killing me 🙂

Any thoughts?

0 Karma
Get Updates on the Splunk Community!

Digital Resilience Assessment Launch | How prepared are you for disruption?

Disruption is inevitable. The question is – how prepared are you to handle it? In today’s fast-moving digital ...

Buttercup Games: Further Dashboarding Techniques (Part 2)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...

Index This | What is the next number in the series? 7,645 5,764 4,576…

February 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...