Splunk Search

Calculate the percentage of logs with a certain criteria among all requests

Path Finder

Hi

Say I have the following log statements (generated throughout the day):

id=111,type=2,field1=y  
id=141,type=23,field1=y  
id=131,type=21,field1=n  
id=121,type=27,field1=n  
...  
...   

How do I calculate the following?
Number of events with field1='y' / Number of total events for that day

Thanks for your help.

1 Solution

Splunk Employee
Splunk Employee

sourcetype=mylogs | stats count(eval(field1=="y")) as ycount, count as totalcount | eval pct=ycount/totalcount

View solution in original post

Splunk Employee
Splunk Employee

If you don't care about events where field1 doesn't exist at all, you could do:

... | top field1 | search field1=y

Since the top command calculates percentage automatically.

Path Finder

Thanks for the response. Certain events may not have the field and we still want to include them in the count.

0 Karma

Splunk Employee
Splunk Employee

sourcetype=mylogs | stats count(eval(field1=="y")) as ycount, count as totalcount | eval pct=ycount/totalcount

View solution in original post

SplunkTrust
SplunkTrust

Its asking stats to count the number of rows in which the eval expression is true, and return that number into a field called ycount. Then asking it to calculate the total number of rows and return that as a field called 'totalcount'.

0 Karma

Path Finder

Thanks much. Could you explain how this actually works? 🙂

0 Karma

Splunk Employee
Splunk Employee

sourcetype=mylogs | timechart count(eval(field1=="y")) as ycount, count as totalcount | eval pct=ycount/totalcount

0 Karma

Path Finder

Thanks. This solution works in calculating the percentage. Is there a way to chart this data over time?

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!