Splunk Search

How to edit my search to get the percentage of hosts by HTTP response code?

JoshuaJohn
Contributor

I have http response codes, and I have hosts.

I want my data to show both of them and how they correlate with each other, I am trying to picture what this would look like, but am having trouble.

Basically this is my search:

index=nitro_ecomm_rest http_Response_code="*" |table host http_Response_code

This shows me every host and every response code.

I would like something more along the lines of every response code with the percentage of a host that is in it so if host: alpha50 has 10 200 http responses and 90 400s under 200, it would show alpha50 10% 10 and under the 400 category 90% 90

This is something I will also be working on for a bit.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code
0 Karma

sundareshr
Legend

Try this

index=nitro_ecomm_rest http_Response_code="*" | chart count over host by http_Response_code
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>