Splunk Search

How do I search if HTTP status for error codes is more than 5% of the overall request, but exclude error code 401?

marees123
Path Finder

Hi All,

I need helping writing a search.

If HTTP status for error codes is more than 5% of the overall request (exclude 401error code)

Please help. Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

View solution in original post

woodcock
Esteemed Legend

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

marees123
Path Finder

thanks a lot:-)

0 Karma

davebrooking
Contributor

Does the following link help? link text

Dave

marees123
Path Finder

Thanks:-).

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...