Splunk Search
Highlighted

How could I chart ratio of counts of field values?

New Member

Hi, suppose my events contain this field with two possible values:

Ok=True or
Ok=False

Every hour, I'll have a certain number ('TTT') of True values and a certain number ('FFF') of False values.

I want to create a chart that shows the failure rate (FFF/(TTT+FFF)) for any given time bucket size.

Is that possible please?

Thanks in advance.

0 Karma
Highlighted

Re: How could I chart ratio of counts of field values?

SplunkTrust
SplunkTrust

Yep. Do this |eval rate = (FFF/(TTT+FFF)) | timechart span=1h avg(rate) as rate

You can set span to whatever you want.

0 Karma
Highlighted

Re: How could I chart ratio of counts of field values?

New Member

Sorry, I'm still a noob when it comes to splunk, but how would I actually obtain the queries for FFF and TTT?
I tried various combinations of this (and the answer below) but nothing gets charted

0 Karma
Highlighted

Re: How could I chart ratio of counts of field values?

Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| bin _time span=1h
| chart count BY _time Ok
| eval pct=100*False/(False+True)
| timechart span=1h first(pct) AS pct

View solution in original post

0 Karma
Highlighted

Re: How could I chart ratio of counts of field values?

Esteemed Legend

I had a mistake and edited my answer to fix it. Try again.

0 Karma
Highlighted

Re: How could I chart ratio of counts of field values?

New Member

This is perfect, thanks! Works like a charm!

0 Karma