Splunk Search

How could I chart ratio of counts of field values?

jchowdown
New Member

Hi, suppose my events contain this field with two possible values:

Ok=True or
Ok=False

Every hour, I'll have a certain number ('TTT') of True values and a certain number ('FFF') of False values.

I want to create a chart that shows the failure rate (FFF/(TTT+FFF)) for any given time bucket size.

Is that possible please?

Thanks in advance.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| bin _time span=1h
| chart count BY _time Ok
| eval pct=100*False/(False+True)
| timechart span=1h first(pct) AS pct

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| bin _time span=1h
| chart count BY _time Ok
| eval pct=100*False/(False+True)
| timechart span=1h first(pct) AS pct
0 Karma

woodcock
Esteemed Legend

I had a mistake and edited my answer to fix it. Try again.

0 Karma

jchowdown
New Member

This is perfect, thanks! Works like a charm!

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Yep. Do this |eval rate = (FFF/(TTT+FFF)) | timechart span=1h avg(rate) as rate

You can set span to whatever you want.

0 Karma

jchowdown
New Member

Sorry, I'm still a noob when it comes to splunk, but how would I actually obtain the queries for FFF and TTT?
I tried various combinations of this (and the answer below) but nothing gets charted

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...