Splunk Search

## How to get a line percentage of 200 responses?

Engager

I have this current search:

index=web
| eval Year=strftime(_time,"%Y")
| eval Month=date_month
| eval success=if(status=200,1=1,0)
| search status=200 OR status=403
| chart count by Month, status
| eval orden = if(Month="january",1,if(Month="february",2,if(Month="march",3,if(Month="april",4,if(Month="may",5,if(Month="june",6,if(Month="july",7,if(Month="august",8,if(Month="september",9,if(Month="october",10,if(Month="november",11,12)))))))))))
| sort orden
| fields - orden

This search shows a graph of the amount of status "200" and "403" separated by months, I'm trying to develop a percentage line of the amount of status 200 compared to the total, how do I do this? can you help me please!

Labels (8)

• ### tstats

1 Solution
SplunkTrust

``````| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total``````

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your

``| eval success=if(status=200,1=1,0)``

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,

SplunkTrust

``````| addtotals
| eval Percent=round('200'/Total*100,2)
| fields - Total``````

then in your bar chart, select the Format/Chart Overlay and add the Percent as a chart overlay and turn on the extra axis and it will give you a line showing the percentage of 200s against the total of 200s + 403s.

If you want the total of all events including other status values, you will need to do it a bit differently.

I know you're not using 'success' value, but your

``| eval success=if(status=200,1=1,0)``

should set the success = 1 not 1=1 and that won't be useful

Also, if you just want 200s and 403s then it's more efficient to put that search constraint in the first search line.,

Get Updates on the Splunk Community!

#### Splunk Edge Processor | Popular Use Cases to Get Started with Edge Processor

Splunk Edge Processor offers more efficient, flexible data transformation – helping you reduce noise, control ...

#### Introducing New Splunkbase Governance!

Splunk apps are essential for maximizing the value of your Splunk Experience. Whether you’re using the default ...

#### 3 Ways to Make OpenTelemetry Even Better

My role as an Observability Specialist at Splunk provides me with the opportunity to work with customers of ...