Splunk Search

Alerting on a percentage of events

tmenagh
Explorer

I want to craft an alert that will get the number of errors:

sourcetype="my-thing" error | stats count

and the number of not errors:

sourcetype="my-thing" NOT error | stats count

then get the percentage of the first over the second

Tags (1)
0 Karma
1 Solution

tmenagh
Explorer

I think I got it:

sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100

View solution in original post

tmenagh
Explorer

I think I got it:

sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100

tmenagh
Explorer

Good call, Reed!

0 Karma

reed_kelly
Contributor

Looking good. I would have thought you want errNo/count*100. If you have only errors, you will get divide by zero error instead of 100%.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...