Splunk Search

Calculate Percentage of status code for 200 by _time

Chirag812
Explorer

I want to calculate the Percentage of status code for 200 out of Total counts of Status code by time. I have written query as per below by using append cols. Below query is working but it is not giving percentage every minute or by _time wise. I want this Percentage of status code for 200 by _time also. So can anybody help me out on this how to write this query.

index=* sourcetype=* host=*
| stats count(sc_status) as Totalcount
| appendcols
[ search index=* sourcetype=* host=* sc_status=200
| stats count(sc_status) as Count200 ]
| eval Percent200=Round((Count200/Totalcount)*100,2)
| fields _time Count200 Totalcount Percent200

Labels (3)
0 Karma

Chirag812
Explorer

Thanks a lot. This worked perfectly.

0 Karma

dtburrows3
Builder

Since you are just wanting to display percentage of 200 and total count of all StatusCode in each minute.
I think a search like this should work.

 

index=<index> sourcetype=<sourcetype> sc_status=*
    | bucket span=1m _time
    | stats
        count as Totalcount,
        count(eval('sc_status'==200)) as Count200
            by _time
    | eval
        Percent200=round(('Count200'/'Totalcount')*100, 2)
    | fields + _time, Percent200, Totalcount

 

Example Output:

dtburrows3_0-1705010117147.png

 

0 Karma
Get Updates on the Splunk Community!

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Stronger Security with Federated Search for S3, GCP SQL & Australian Threat ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...