Splunk Search

## How to get a line percentage of 200 responses?

Engager

I have this current search:

index=web
| eval Year=strftime(_time,"%Y")
| eval Month=date_month
| eval success=if(status=200,1=1,0)
| search status=200 OR status=403
| chart count by Month, status
| eval orden = if(Month="january",1,if(Month="february",2,if(Month="march",3,if(Month="april",4,if(Month="may",5,if(Month="june",6,if(Month="july",7,if(Month="august",8,if(Month="september",9,if(Month="october",10,if(Month="november",11,12)))))))))))
| sort orden
| fields - orden

This search shows a graph of the amount of status "200" and "403" separated by months, I'm trying to develop a percentage line of the amount of status 200 compared to the total, how do I do this? can you help me please!

Labels (8)

• ### tstats

1 Solution
SplunkTrust

``````| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total``````

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your

``| eval success=if(status=200,1=1,0)``

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,

SplunkTrust

``````| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total``````

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your

``| eval success=if(status=200,1=1,0)``

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,

Get Updates on the Splunk Community!

#### 3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...

#### What's New in Splunk Cloud Platform 9.2.2406?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2406 with many ...

#### Enterprise Security Content Update (ESCU) | New Releases

In August, the Splunk Threat Research Team had 3 releases of new security content via the Enterprise Security ...