Splunk Search

Calculating % error rate from a single field for a timechart

dreeck
Path Finder

Hey All,

I'm trying to make a timechart that shows the % of un-successful requests processed every hour. Success (or not) is represented in the 'info' field as 4 separate values: granted, canceled, failed, and completed. I'd like to group 'failed/canceled' into a single value called 'errors', and then divide errors by total requests to get a error rate percentage.

| eval status=if(IN(info,"canceled","failed"), "failed","success")

| timechart count(status) by status

The snippet above let's me generate a 'stacked 100%' chart that comes close, but I really am looking for a line chart that shows only error rate percentage. If feels like I'm missing something ultra basic, but I haven't found an answer yet. Seems like it should be close to

| stats = count as total
| eval status=if(IN(info,"canceled","failed"), "1","0")

| eval error_rate = count(status)/total

Tips appreciated!

Dave

1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@dreeck,

Try

|timechart span=1h count as total,count(eval(status=="canceled" OR status=="failed")) as error
| eval error_rate=error/total
| fields - total,count

Adjust the fields/calcs according to your final requirements.

Happy Splunking!

View solution in original post

renjith_nair
SplunkTrust
SplunkTrust

@dreeck,

Try

|timechart span=1h count as total,count(eval(status=="canceled" OR status=="failed")) as error
| eval error_rate=error/total
| fields - total,count

Adjust the fields/calcs according to your final requirements.

Happy Splunking!

dreeck
Path Finder

Thank you Renjith! This gets me very close. What I'd like to do is show only the error rate. This shows the total, error and error rate lines. Got a tip on how to calculate error rate without showing total & count?

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@dreeck, yep just remove the fields using

|fields - total,count

Updated the answer

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...