Splunk Search

Exclude search result

polymorphic
Communicator

Hi all

This might be very straight forward, but i cant get my head around it, so i hope someone is able to help me out.

The task is to show every hostname with a value greater than 5 on failedpct.

This is my search:

sourcetype=stats | stats first(customername) as customer, last(monPingGWCheck) AS upstatus, count, count(FailedModulesString) AS failedcount by hostname | eval failedpct=failedcount/count*100 | eval failedpct=if(upstatus == 1, failedpct, 0) | sort customer, -failedpct | table customer, hostname, upstatus, count, failedcount, failedpct

Any suggestion?

Tags (1)
0 Karma
1 Solution

Ayn
Legend
... | where failedpct>5

View solution in original post

Ayn
Legend
... | where failedpct>5

polymorphic
Communicator

As i said, VERY straight forward. 🙂
Thank you very much.

0 Karma
Get Updates on the Splunk Community!

Synthetic Monitoring: Not your Grandma’s Polyester! Tech Talk: DevOps Edition

Register today and join TekStream on Tuesday, February 28 at 11am PT/2pm ET for a demonstration of Splunk ...

Instrumenting Java Websocket Messaging

Instrumenting Java Websocket MessagingThis article is a code-based discussion of passing OpenTelemetry trace ...

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...