Splunk Search
Highlighted

How to combine 2 search results and calculate error rate?

New Member

I am trying to determine the error rate.

Total Count per URI:

index=applogsprd java_class="*content.common.spring.LoggingInterceptor*” uri="*/api/v*"   | fields uri | stats Count as count,  by uri

Error Count per URI:

index=applogsprd java_class="*content.ws.rest.v1.error.ErrorHandler*" uri="*/api/v*" | fields uri | stats Count as errorCount,  by uri

The result I'm looking for is a table:
uri , totalCount, errorCount, error rate (errorCount/totalCount)

I've tried appendcols, but can't seem to make that work.

0 Karma
Highlighted

Re: How to combine 2 search results and calculate error rate?

Legend

Try this

index=applogsprd uri="/api/v"  | stats count(eval(java_class="content.common.spring.LoggingInterceptor”)) as count count(eval(java_class="content.ws.rest.v1.error.ErrorHandler")) as error  | eval errorRate=error/count
0 Karma