How to create report on failure rates using count of errors per session and total number of sessions?

[sjnorman]

We'd like to be able to report on failure rates within our application. The metric we will use is errors per session / total # of sessions.

We can identify when a user logs in by searching for a particular search phrase (i.e. "user X logged in") and when an error occurs ("error X occurred while processing the request for user X").

So, total # of sessions = number of log statements that contain the text "user X logged in"
errors per session = number of log statements that contain the text "error X occurred while processing the request for user X"

I know that I can get a count for each of the two statement types, but how do I feed that into a single report?

[sjnorman]

I used your suggestion below but matched on raw search terms.

stats count(eval(match(_raw,"login search terms"))) as TotalSessions, count(eval(match(_raw,"error search terms"))) as TotalErrors | eval FailureRate = TotalErrors/TotalSessions

[strive · Accepted solution]

Assuming that you have written regexes to extract both the texts and the field names that you have given are: UserLogin, Error

Then you can write search like this

Some search terms... | stats count(UserLogin) as TotalSessions, count(Error) as TotalErrors | eval FailureRate = TotalErrors/TotalSessions

[sjnorman]

Wouldn't the login and error statements be considered event types, and within those types, fields would be things such as user ID, error type, etc.?

i.e.
user X logged in = Login event type
X = user_id field

Maybe I'm misunderstanding what Splunk considers a field?