I'm new to Splunk and am not quite sure how to approach this. I have several different automated jobs such as generating checksums, tar and ffmpeg transcodes and they all write job information to log files like this:
job="filename.txt", job_status=outgoing, job_result=True
job="filename2.txt", job_status=outgoing, job_result=False, error-type="file-read-error"
What I am interested in is finding out is how many of each job ends in failure grouped by each automated process, which are different source types to Splunk, all part of the same index
So I'm looking to create a table like this:
sourcetype, # of jobs, # of success, # of fail, % of jobs that failed
checksum, 1000, 900, 100, %10
I can run this search:
index=automatedprocesses job_status=outgoing | stats count by sourcetype
and get the first two columns of my table.
I can run:
index=automatedprocesses job_status=outgoing job_result=True | stats count by sourcetype
index=automatedprocesses job_status=outgoing job_result=False | stats count by sourcetype
to get the next two columns, but I can't figure out how to run them all together (Or more efficiently, run 1 search and count the values based on those results) and then get the % column at the end.
I've done this
index=automatedprocesses job_status=outgoing | stats values(job_result) AS result by sourcetype
but it just tells me that job_result has True and False responses...
Any advice is appreciated, thanks.
Do like this
index=automatedprocesses job_status=outgoing | chart count over sourcetype by job_result
| rename True as Success False as Failure | addtotals | eval Perc_Fail=round(Failure*100/Total,2)
View solution in original post