Splunk Search

Hi all, i have been trying to figure out how to use timechart with percentages. I have the following command which gives me the percentages but have not sucessfully able to use this with timechart.

New Member

index=alarm* host="" Message.EventCategory="Error" OR "ERROR" | stats count as Error| eval Events= [search "" | stats count as search] | eval "Error Percentage" = (Error/Events)*100 | fields Events Error "Error Percentage"

Any helps would be very welcome.

Thanks
Sean

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Try this:

  index=alarm* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as error
| appendcols [tstats count by _time prestats=t | timechart count]
| eval Error Percentage = error / count * 100 | fields - error count

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Try this:

  index=alarm* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as error
| appendcols [tstats count by _time prestats=t | timechart count]
| eval Error Percentage = error / count * 100 | fields - error count

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Yeah, 5.0 had a less feature-rich first version of tstats. I highly recommend upgrading!

Use this while on 5.0:

  index=alarm* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as error
| appendcols [| metasearch * | timechart count]
| eval Error Percentage = error / count * 100 | fields - error count
0 Karma

New Member

Hi Martin,

Thanks for the quick reply. I have tried to run this but it throws the following error:-

Error in 'TsidxStats': Missing 'FROM' keyword to specify namespace.

I am still looking at this but do you have any ideas?

Thanks
Sean

0 Karma

New Member

Hi Martin,

I changed it slightly to suit my needs but many thanks for your help.

index=alarm* host="" Message.EventCategory="Error" OR "ERROR" | stats count as Error| eval Events= [search "" | stats count as search] | eval "Error Percentage" = (Error/Events)*100 | fields Events Error "Error Percentage"

0 Karma

New Member

Hi Martin,

It appears that my version of Splunk (5.0.5, build 179365) will not work with tstats as this was introduced in version 6.

I have amended the search as below:

index=* host="*" Message.EventCategory="Error" OR "ERROR" | timechart count as Error | appendcols [stats count by _time |
timechart count] | eval "Error Percentage" = error / count * 100 | fields Error Count Percentage

but this only brings back results for the errors 😞

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!