Hello Everyone,
This is the extension of previous query which I posted- https://community.splunk.com/t5/Splunk-Search/How-would-I-write-a-Splunk-search-to-build-a-table-for...
Thanks to @ITWhisperer and updated query worked well.
Now I am trying to add percentage column for PASS and FAIL, instead of the count:
_time | success | fail |
2023-05-28 03:00 | 98 | 2 |
2023-05-28 04:00 | 60 | 40 |
2023-05-28 05:00 | 100 | 0 |
I was trying to build a query, something like this:
index=my_index sourcetype=openshift_logs openshift_namespace=my_ns openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*)
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES
| search "message.url"="/shopping/carts/*"
```| timechart span=1h dc("message.tracers.ek-correlation-id{}") as count by status```
| eventstats count("message.tracers.ek-correlation-id{}") as totalCount
| eventstats count("message.tracers.ek-correlation-id{}") as individualCount by status
| eval percent=(individualCount/totalCount)*100
I know the above query is incomplete and not sure if this the right way to proceed.
Just overwrite the success and fail fields
index=my_index sourcetype=openshift_logs openshift_namespace=my_ns openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*)
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES
| search "message.url"="/shopping/carts/*"
| timechart span=1h dc("message.tracers.correlation-id{}") as count by status pct
| addtotals
| eval success=round(100*success/Total,1)
| eval fail=round(100*fail/Total,1)
Instead of the last 3 lines, try this
| addtotals
| eval successpercent=100*success/Total
Hello @ITWhisperer
I am getting the below data as the result:
index=my_index sourcetype=openshift_logs openshift_namespace=my_ns openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*)
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES
| search "message.url"="/shopping/carts/*"
| timechart span=1h dc("message.tracers.correlation-id{}") as count by status pct
| addtotals
| eval successpercent=round(100*success/Total,1)
| eval failpercent=round(100*fail/Total,1)
But I am looking for only successpercent and failpercent to be displayed in the table.
Just overwrite the success and fail fields
index=my_index sourcetype=openshift_logs openshift_namespace=my_ns openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*)
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES
| search "message.url"="/shopping/carts/*"
| timechart span=1h dc("message.tracers.correlation-id{}") as count by status pct
| addtotals
| eval success=round(100*success/Total,1)
| eval fail=round(100*fail/Total,1)
this command helped:
|fields _time successpercent failpercent