Splunk Search

How do I modify my search to output results in certain colors based on different ranges of percentage values?

tanhadil4vr
New Member

Hi Everyone,

I have this query which is running and giving me the difference of errors from yesterday and today based on Name, but need a little help in modifying it.

earliest="-1500m@m" latest="-1440m@m" index=Test host=* | chart count(Errors) as "Yesterday" by Name | join type=outer Name [search index=Test host=* earliest =-60m@m latest=now | chart count(Errors) as "Today" by Name] | eval errDiff=(((Today-Yesterday)/Yesterday)*100) . "%" | sort -Yesterday

It is giving the desired result.
But now I want to get the result based on the % of errors.

For e.g
errDiff 0-24 must be GREEN
errDiff 25-49 must be YELLOW
errDiff >50 must be RED

earliest="-1500m@m" latest="-1440m@m" index=Test host=* | chart count(Errors) as "Yesterday" by Name | join type=outer Name [search index=Test host=* earliest =-60m@m latest=now | chart count(Errors) as "Today" by Name] | eval errDiff=(((Today-Yesterday)/Yesterday)*100) | eval errDiff=case(errDiff>=0 AND errDiff<25, "GREEN", errDiff>=25 AND errDiff<50, "YELLOW", errDiff>=50, "RED") | sort -Yesterday

This one is coming perfectly, but it is not showing the errDiff %. I need errDiff % as well as the classification based on color...

Any leads?

TIA

0 Karma

sundareshr
Legend
Get Updates on the Splunk Community!

New This Month in Splunk Observability Cloud - Metrics Usage Analytics, Enhanced K8s ...

The latest enhancements across the Splunk Observability portfolio deliver greater flexibility, better data and ...

Alerting Best Practices: How to Create Good Detectors

At their best, detectors and the alerts they trigger notify teams when applications aren’t performing as ...

Discover Powerful New Features in Splunk Cloud Platform: Enhanced Analytics, ...

Hey Splunky people! We are excited to share the latest updates in Splunk Cloud Platform 9.3.2408. In this ...