Splunk Search

Calculate percentage by eval status

Noah
Explorer

Hi Everyone! 

Could you please help, how to calculate (UP percentage) by app_service 

I have the query as: 

eval status=if(success="successful .Statuscode:200", "UP", "DOWN"
| table   app_service    status

I get the table I need, but I have difficulty calculating the "UP" percentage and total percentage per app_service from the above query

Thank you 

Labels (4)
0 Karma
1 Solution

venkatasri
SplunkTrust
SplunkTrust

Hi @Noah 

Can you try this?

| makeresults 
| eval success="successful .Statuscode:200" , app_service="jobber"
| eval status=if(success="successful .Statuscode:200", "UP", "DOWN") 
| stats count, count(eval(status="UP")) as up_count by app_service 
| eval perc= round((up_count/count) * 100,4)
| table count up_count app_service perc

An upvote would be appreciated and Accept solution if this reply helps!

View solution in original post

venkatasri
SplunkTrust
SplunkTrust

Hi @Noah 

Can you try this?

| makeresults 
| eval success="successful .Statuscode:200" , app_service="jobber"
| eval status=if(success="successful .Statuscode:200", "UP", "DOWN") 
| stats count, count(eval(status="UP")) as up_count by app_service 
| eval perc= round((up_count/count) * 100,4)
| table count up_count app_service perc

An upvote would be appreciated and Accept solution if this reply helps!

Noah
Explorer

Thank you @venkatasri Venkatasri! This definitely helped with some modifications. Much appreciated! 

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...