New Splunk user. I am creating web dashboards and I want to calculate the percentage of successful status codes. The logs are IIS. I am trying to create a search that takes the total status codes (sc_status="*") and divides by the successful status codes (sc_status<=400). I am just trying to create a single value quick reference that shows the percentage of success. I know I need to use eval to define the fields but I am having problems understanding how to put the different values together. When I do the following search I get No results found.
| stats count(eval(sc_status="*")) AS total, count(eval(sc_status<=400)) AS success | eval percent_difference=((success/total)*100) | table percent_difference
Try this
Your base search | stats count(sc_status) AS total, count(eval(sc_status<=400)) AS success | eval percent_difference=((success/total)100) | table percent_difference
Try this
Your base search | stats count(sc_status) AS total, count(eval(sc_status<=400)) AS success | eval percent_difference=((success/total)100) | table percent_difference
Thanks for the quick reply, working great now!