Splunk Search

How do I search if HTTP status for error codes is more than 5% of the overall request, but exclude error code 401?

marees123
Path Finder

Hi All,

I need helping writing a search.

If HTTP status for error codes is more than 5% of the overall request (exclude 401error code)

Please help. Thanks.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

View solution in original post

woodcock
Esteemed Legend

Like this:

... | timechart span=1h count as total count(eval(tonumber(http_status)>=400)) AS statusCount400andUp count(eval(tonumber(http_status)=401)) AS statusCount401 | eval pctMyBad = 100*(statusCount400andUp - statusCount401)/total | where pctMyBad > 5

View solution in original post

marees123
Path Finder

thanks a lot:-)

0 Karma

davebrooking
Contributor

Does the following link help? link text

Dave

marees123
Path Finder

Thanks:-).

0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!