Splunk Search

How to edit my search to get the percentage of hosts by HTTP response code?

JoshuaJohn
Contributor

I have http response codes, and I have hosts.

I want my data to show both of them and how they correlate with each other, I am trying to picture what this would look like, but am having trouble.

Basically this is my search:

index=nitro_ecomm_rest http_Response_code="*" |table host http_Response_code

This shows me every host and every response code.

I would like something more along the lines of every response code with the percentage of a host that is in it so if host: alpha50 has 10 200 http responses and 90 400s under 200, it would show alpha50 10% 10 and under the 400 category 90% 90

This is something I will also be working on for a bit.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code
0 Karma

sundareshr
Legend

Try this

index=nitro_ecomm_rest http_Response_code="*" | chart count over host by http_Response_code
0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

March Community Office Hours Security Series Uncovered!

Hello Splunk Community! In March, Splunk Community Office Hours spotlighted our fabulous Splunk Threat ...

Stay Connected: Your Guide to April Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars in April. This post ...