Splunk Search

## How to get a line percentage of 200 responses?

Engager

I have this current search:

index=web
| eval Year=strftime(_time,"%Y")
| eval Month=date_month
| eval success=if(status=200,1=1,0)
| search status=200 OR status=403
| chart count by Month, status
| eval orden = if(Month="january",1,if(Month="february",2,if(Month="march",3,if(Month="april",4,if(Month="may",5,if(Month="june",6,if(Month="july",7,if(Month="august",8,if(Month="september",9,if(Month="october",10,if(Month="november",11,12)))))))))))
| sort orden
| fields - orden

This search shows a graph of the amount of status "200" and "403" separated by months, I'm trying to develop a percentage line of the amount of status 200 compared to the total, how do I do this? can you help me please!

Labels (8)

• ### tstats

1 Solution
SplunkTrust

``````| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total``````

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your

``| eval success=if(status=200,1=1,0)``

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,

SplunkTrust

``````| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total``````

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your

``| eval success=if(status=200,1=1,0)``

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,

Get Updates on the Splunk Community!

#### Monitoring Postgres with OpenTelemetry

Behind every business-critical application, you’ll find databases. These behind-the-scenes stores power ...

#### Mastering Synthetic Browser Testing: Pro Tips to Keep Your Web App Running Smoothly

To start, if you're new to synthetic monitoring, I recommend exploring this synthetic monitoring overview. In ...

#### Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...