Splunk Search

## Calculating % error rate from a single field for a timechart

Path Finder

Hey All,

I'm trying to make a timechart that shows the % of un-successful requests processed every hour. Success (or not) is represented in the 'info' field as 4 separate values: granted, canceled, failed, and completed. I'd like to group 'failed/canceled' into a single value called 'errors', and then divide errors by total requests to get a error rate percentage.

| eval status=if(IN(info,"canceled","failed"), "failed","success")

| timechart count(status) by status

The snippet above let's me generate a 'stacked 100%' chart that comes close, but I really am looking for a line chart that shows only error rate percentage. If feels like I'm missing something ultra basic, but I haven't found an answer yet. Seems like it should be close to

| stats = count as total
| eval status=if(IN(info,"canceled","failed"), "1","0")

| eval error_rate = count(status)/total

Tips appreciated!

Dave

Tags (2)
1 Solution
SplunkTrust

@dreeck,

Try

``````|timechart span=1h count as total,count(eval(status=="canceled" OR status=="failed")) as error
| eval error_rate=error/total
| fields - total,count
``````

Happy Splunking!
SplunkTrust

@dreeck,

Try

``````|timechart span=1h count as total,count(eval(status=="canceled" OR status=="failed")) as error
| eval error_rate=error/total
| fields - total,count
``````

Happy Splunking!
Path Finder

Thank you Renjith! This gets me very close. What I'd like to do is show only the error rate. This shows the total, error and error rate lines. Got a tip on how to calculate error rate without showing total & count?

SplunkTrust

@dreeck, yep just remove the fields using

`|fields - total,count`

Happy Splunking!
Get Updates on the Splunk Community!

#### Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...

#### Splunkbase | Splunk Dashboard Examples App for SimpleXML End of Life

The Splunk Dashboard Examples App for SimpleXML will reach end of support on Dec 19, 2024, after which no new ...

#### Understanding Generative AI Techniques and Their Application in Cybersecurity

Watch On-Demand Artificial intelligence is the talk of the town nowadays, with industries of all kinds ...