I am calculating number of web-calls that were served in certain seconds.
| stats count(web-calls) as web-call-count by server_response.
So, in x axis I see the seconds, and Y axis i see the number of web-calls ..in a column chart.
What we are looking for is, "Can we get the percentage of web-calls instead of count in Y-axis" ?
@zacksoft
Can you please try this?
YOUR_SEARCH | stats count(web-calls) as web-call-count by server_response | eventstats sum(web-call-count) as total | eval percentage=round((web-call-count*100/total),2) | table server_response percentage
@zacksoft
Can you please try this?
YOUR_SEARCH | stats count(web-calls) as web-call-count by server_response | eventstats sum(web-call-count) as total | eval percentage=round((web-call-count*100/total),2) | table server_response percentage
The command works perfectly. Thank you...
If I may add one more thing, Is it possible to create buckets ..say something like 3 buckets.
Bucket 1 showing the percentage of web-calls whose response were less than a second.
Bucket 2 showing percentage of web-calls ...between 1 to 10 sec.
Bucket 3 showing ..more tan 10 sec..
May be in a column chart showing three columns as three buckets or any other way..we can visualize ???
@zacksoft
Yes, we can eval one more filed Bucket
. For this sample data and expected output will be appreciated. 🙂
I have put some sample data here along with more description
https://answers.splunk.com/answers/742026/creating-buckets-based-a-percentage-of-occurrence.html?min...