Splunk Search

How can I graph percent fails by host over time?


OK - I can't get this simple chart to work. Just need to graph Percent Fails by host over time

this is my start right now

index=app sourcetype=app_source source=*source.log "failedfor" OR "worked"
| bucket span=30m _time
| eval bad=if(searchmatch("failedfor"),1,0)
| stats count as total sum(bad) as bad by host
| eval conversion=(bad/total)*100

I can get like variations of the correct stats, but not charted by time and host (% over 30m plot points)..

thank you!

0 Karma


You almost had it. In order to chart across time ( timechart ), you need the _time field.

Your stats command does not include the _time field, so the field stopped existing after that command.

Change to ...

  | stats count as total sum(bad) as bad by host _time
0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...