Splunk Search

## How to create top command results in timechart?

Communicator

I'm trying to make a timechart to show percentage of error rates over a given time period. What I am looking for from a visualization perspective is a line chart that shows for any binned time period, what the total count of a specific error was, and what the overall percentage that was, and to have the chart be drawn based on the percentage.

Ideally, I'd have both counts and percents on the same chart, but percentage is the important one so I can calculate percentage error over a given timeperiod.

So far, my query is as follows:

``````Initial Search to create the necessary variables|table errorCode _time|bin span=5m _time| eventstats count as total by _time
| stats count values(total) as total by _time, errorCode
``````

errorCode contains a variety of values, with one value corresponding to success. In theory this should give me a table that looks like

``````_time               errorCode               count          total
Bucket1          ErrorCode1             X                  X+Y+Z
Bucket1          ErrorCode2             Y                  X+Y+Z
Bucket1          Success                Z                  X+Y+Z
``````

From there I would be able to use an `eval perc=count/total*100` to be able to build the timechart. However, the total column is incorrect and does not result in the correct values. What would be a better way to build this query out, and is it possible to have the chart be drawn based on percent, but have in any given tooltip percent and count values?

Tags (3)
1 Solution
SplunkTrust

Try this

``````Initial Search to create the necessary variables
| bin span=5m _time
| table errorCode _time
| stats count by _time, errorCode
| eventstats sum(count) as total by _time
| eval perc=round((count*100)/total,2)
``````

let me know if this helps!

SplunkTrust

Try this

``````Initial Search to create the necessary variables
| bin span=5m _time
| table errorCode _time
| stats count by _time, errorCode
| eventstats sum(count) as total by _time
| eval perc=round((count*100)/total,2)
``````

let me know if this helps!

Communicator

Yep, it works.

If I add in a `|timechart values(perc) by errorCode` it creates a visualization.

Thanks!

State of Splunk Careers