Splunk Search

How do you plot a table of error status codes where there are percentages in the logs?

saifullakhalid
Explorer

The below query gives the count of each status code 302, 404, 500 etc , Can you please suggest how should I get the percentage of each error code in the logs.

index=test1 source="/var/log/*ui*"requestOrigin=external (stack_name="*prod*" OR NMG_Stack_Name="*prod*") (requestUrl="*/p/*" OR  requestUrl="*/c*") statusCode!=200 NOT userAgent="*HealthChecker*" | eval rt=responseTime| rex field=requestUrl "((?\/c\/|^\/$))" | stats count as "Count" by  statusCode

Actual Output:

statusCode | Count
301 | 1
302 | 4619
404 | 180

Sample Expected Output:

statusCode | Count. | %Percentage
301 | 1 | %2
302 | 4619. | %20
404 | 180 | %5

Tags (1)
0 Karma

FrankVl
Ultra Champion

A very easy way to do that is to do | top statusCode instead of the stats command.

Note this by default returns only the top 10 results, you can control that by adding limit=N to show the top N results (use 0 to remove the limit). For details see: http://docs.splunk.com/Documentation/Splunk/7.2.1/SearchReference/Top

0 Karma

saifullakhalid
Explorer

My question was how to get the % percentage

0 Karma

FrankVl
Ultra Champion

Yes, have you tried the top command? That shows the top items along with count and percentage.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...