Splunk Search

How to create a search that calculates percentage from 2 different values in the same field.

Bliide
Path Finder

New Splunk user. I am creating web dashboards and I want to calculate the percentage of successful status codes. The logs are IIS. I am trying to create a search that takes the total status codes (sc_status="*") and divides by the successful status codes (sc_status<=400). I am just trying to create a single value quick reference that shows the percentage of success. I know I need to use eval to define the fields but I am having problems understanding how to put the different values together. When I do the following search I get No results found.

| stats count(eval(sc_status="*")) AS total, count(eval(sc_status<=400)) AS success | eval percent_difference=((success/total)*100) | table percent_difference

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

Your base search | stats count(sc_status) AS total, count(eval(sc_status<=400)) AS success | eval percent_difference=((success/total)100) | table percent_difference

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

Your base search | stats count(sc_status) AS total, count(eval(sc_status<=400)) AS success | eval percent_difference=((success/total)100) | table percent_difference

Bliide
Path Finder

Thanks for the quick reply, working great now!

0 Karma
Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

Splunk is officially part of Cisco

Revolutionizing how our customers build resilience across their entire digital footprint.   Splunk ...

Splunk APM & RUM | Planned Maintenance March 26 - March 28, 2024

There will be planned maintenance for Splunk APM and RUM between March 26, 2024 and March 28, 2024 as ...