Splunk Search

How do I search if HTTP status for error codes is more than 5% of the overall request, but exclude error code 401?

Path Finder

Hi All,

I need helping writing a search.

If HTTP status for error codes is more than 5% of the overall request (exclude 401error code)

Please help. Thanks.

0 Karma
1 Solution

Esteemed Legend

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

View solution in original post

Esteemed Legend

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

View solution in original post

Path Finder

thanks a lot:-)

0 Karma

Contributor

Does the following link help? link text

Dave

Path Finder

Thanks:-).

0 Karma