Help calculating error breach rate

[jche714]

Hi,

I'm trying to build a splunk query to calculate error rate breaches. Essentially, how often in 5 minute intervals, do we surpass our error rate threshold. I'm having difficulty though in getting my query to work and wanted to get assistance.

The issue that I'm having is that I'm unable to get the actual count of the logs that match "tags{}"=error. This is always returning 0 for me. What's odd though, is that this is a valid field on the log object and can be queried for, so I'm not why the count isn't being captured.

Context: tags is an array of string. So for example, tags: [info, error, metric, …]

This is my query:

index=my-index

| bucket _time span=5m

| stats count(eval("tags{}"=error)) as errorCount, count as total by _time

| eval errorRate = (errorCount/total)

| eval breaches=if(errorRate > .05, 1, 0)

| stats sum(breaches) as breachCount, count(total) as totalSamples

| eval HowOftenWeHitOurTarget=100*(1-(breachCount/totalSamples))

[ITWhisperer]

Try single quotes rather than double quotes around the field name.

[jche714]

@ITWhisperer I just tried this out and no luck 😞 I'm curious though, is there a difference between single and double quote usage?

[ITWhisperer]

Double quotes is usually used for string values, and single quotes for field names which contain spaces or dots etc.