Splunk Search

Hi all, i have been trying to figure out how to use timechart with percentages. I have the following command which gives me the percentages but have not sucessfully able to use this with timechart.

seanmylne
New Member

index=alarm* host="" Message.EventCategory="Error" OR "ERROR" | stats count as Error| eval Events= [search "" | stats count as search] | eval "Error Percentage" = (Error/Events)*100 | fields Events Error "Error Percentage"

Any helps would be very welcome.

Thanks
Sean

0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Try this:

  index=alarm* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as error
| appendcols [tstats count by _time prestats=t | timechart count]
| eval Error Percentage = error / count * 100 | fields - error count

View solution in original post

0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Try this:

  index=alarm* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as error
| appendcols [tstats count by _time prestats=t | timechart count]
| eval Error Percentage = error / count * 100 | fields - error count
0 Karma

martin_mueller
SplunkTrust
SplunkTrust

Yeah, 5.0 had a less feature-rich first version of tstats. I highly recommend upgrading!

Use this while on 5.0:

  index=alarm* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as error
| appendcols [| metasearch * | timechart count]
| eval Error Percentage = error / count * 100 | fields - error count
0 Karma

seanmylne
New Member

Hi Martin,

Thanks for the quick reply. I have tried to run this but it throws the following error:-

Error in 'TsidxStats': Missing 'FROM' keyword to specify namespace.

I am still looking at this but do you have any ideas?

Thanks
Sean

0 Karma

seanmylne
New Member

Hi Martin,

I changed it slightly to suit my needs but many thanks for your help.

index=alarm* host="" Message.EventCategory="Error" OR "ERROR" | stats count as Error| eval Events= [search "" | stats count as search] | eval "Error Percentage" = (Error/Events)*100 | fields Events Error "Error Percentage"

0 Karma

seanmylne
New Member

Hi Martin,

It appears that my version of Splunk (5.0.5, build 179365) will not work with tstats as this was introduced in version 6.

I have amended the search as below:

index=* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as Error | appendcols [stats count by _time |
timechart count] | eval "Error Percentage" = error / count * 100 | fields Error Count Percentage

but this only brings back results for the errors 😞

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...