Splunk Search

Calculate Percentage of status code for 200 by _time

Chirag812
Explorer

I want to calculate the Percentage of status code for 200 out of Total counts of Status code by time. I have written query as per below by using append cols. Below query is working but it is not giving percentage every minute or by _time wise. I want this Percentage of status code for 200 by _time also. So can anybody help me out on this how to write this query.

index=* sourcetype=* host=*
| stats count(sc_status) as Totalcount
| appendcols
[ search index=* sourcetype=* host=* sc_status=200
| stats count(sc_status) as Count200 ]
| eval Percent200=Round((Count200/Totalcount)*100,2)
| fields _time Count200 Totalcount Percent200

Labels (3)
0 Karma

Chirag812
Explorer

Thanks a lot. This worked perfectly.

0 Karma

dtburrows3
Builder

Since you are just wanting to display percentage of 200 and total count of all StatusCode in each minute.
I think a search like this should work.

 

index=<index> sourcetype=<sourcetype> sc_status=*
    | bucket span=1m _time
    | stats
        count as Totalcount,
        count(eval('sc_status'==200)) as Count200
            by _time
    | eval
        Percent200=round(('Count200'/'Totalcount')*100, 2)
    | fields + _time, Percent200, Totalcount

 

Example Output:

dtburrows3_0-1705010117147.png

 

0 Karma
Get Updates on the Splunk Community!

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...