Splunk Search

How to edit my search to get the percentage of hosts by HTTP response code?

JoshuaJohn
Contributor

I have http response codes, and I have hosts.

I want my data to show both of them and how they correlate with each other, I am trying to picture what this would look like, but am having trouble.

Basically this is my search:

index=nitro_ecomm_rest http_Response_code="*" |table host http_Response_code

This shows me every host and every response code.

I would like something more along the lines of every response code with the percentage of a host that is in it so if host: alpha50 has 10 200 http responses and 90 400s under 200, it would show alpha50 10% 10 and under the 400 category 90% 90

This is something I will also be working on for a bit.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

index=nitro_ecomm_rest http_Response_code="*" | stats count by host http_Response_code | eventstats sum(count) as Total by host | eval Percent=round(count*100/Total,2) | eval ValueToShow=Percent." % - ".count | chart values(ValueToShow) over host by http_Response_code
0 Karma

sundareshr
Legend

Try this

index=nitro_ecomm_rest http_Response_code="*" | chart count over host by http_Response_code
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...