Splunk Search

Help calculating error breach rate

jche714
Observer

Hi,

I'm trying to build a splunk query to calculate error rate breaches. Essentially, how often in 5 minute intervals, do we surpass our error rate threshold. I'm having difficulty though in getting my query to work and wanted to get assistance.

The issue that I'm having is that I'm unable to get the actual count of the logs that match "tags{}"=error. This is always returning 0 for me. What's odd though, is that this is a valid field on the log object and can be queried for, so I'm not why the count isn't being captured.

Context: tags is an array of string. So for example, tags: [info, error, metric, …]

This is my query:

 

 

index=my-index

| bucket _time span=5m

| stats count(eval("tags{}"=error)) as errorCount, count as total by _time

| eval errorRate = (errorCount/total)

| eval breaches=if(errorRate > .05, 1, 0)

| stats sum(breaches) as breachCount, count(total) as totalSamples

| eval HowOftenWeHitOurTarget=100*(1-(breachCount/totalSamples))

 

 

 

Labels (3)
0 Karma

ITWhisperer
Ultra Champion

Try single quotes rather than double quotes around the field name.

0 Karma

jche714
Observer

@ITWhisperer I just tried this out and no luck 😞 I'm curious though, is there a difference between single and double quote usage?

0 Karma

ITWhisperer
Ultra Champion

Double quotes is usually used for string values, and single quotes for field names which contain spaces or dots etc.

0 Karma