Splunk Search
Highlighted

How do I get the failure status for that percentile?

Communicator

i want to calculate failure status 404 for service name .when the status is reached 90% .I need to trigger email?

index=xxx* |eventstats count(eval(Proxy)) as "totcnt" count(eval(Status="404")) as "failurecnt" by Name |stats perc90(failurecnt) as perc90_avg by Name

Tags (2)
0 Karma
Highlighted

Re: How do I get the failure status for that percentile?

SplunkTrust
SplunkTrust

Try this (not sure if need to use percentile, just percentage should do it)
Updated

index=xxx* 
|stats count(Proxy) as "totcnt" count(eval(Status="404")) as "failurecnt" by Name 
|eval failurepercent=failurecnt*100/totcnt | where failurepercent>90
Highlighted

Re: How do I get the failure status for that percentile?

Champion

Unless I'm missing something, count(eval(Proxy)) could be more simply written count(Proxy), which will give the count of values in the Proxy field.

Highlighted

Re: How do I get the failure status for that percentile?

SplunkTrust
SplunkTrust

You're correct. Didn't look for that before. Corrected.

0 Karma