Splunk Search

Help calculating error breach rate

jche714
Observer

Hi,

I'm trying to build a splunk query to calculate error rate breaches. Essentially, how often in 5 minute intervals, do we surpass our error rate threshold. I'm having difficulty though in getting my query to work and wanted to get assistance.

The issue that I'm having is that I'm unable to get the actual count of the logs that match "tags{}"=error. This is always returning 0 for me. What's odd though, is that this is a valid field on the log object and can be queried for, so I'm not why the count isn't being captured.

Context: tags is an array of string. So for example, tags: [info, error, metric, …]

This is my query:

 

 

index=my-index

| bucket _time span=5m

| stats count(eval("tags{}"=error)) as errorCount, count as total by _time

| eval errorRate = (errorCount/total)

| eval breaches=if(errorRate > .05, 1, 0)

| stats sum(breaches) as breachCount, count(total) as totalSamples

| eval HowOftenWeHitOurTarget=100*(1-(breachCount/totalSamples))

 

 

 

Labels (3)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try single quotes rather than double quotes around the field name.

0 Karma

jche714
Observer

@ITWhisperer I just tried this out and no luck 😞 I'm curious though, is there a difference between single and double quote usage?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Double quotes is usually used for string values, and single quotes for field names which contain spaces or dots etc.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...