Splunk Search

How to get the percentage of each HTTP status code

Path Finder

I would like to get the percentage of each HTTP status code. I have the count of each status code that appears and I just need a way to divide each code by the total number so I can get the percentage.

0 Karma
1 Solution

Path Finder

Assuming you have a table reflecting a column of http codes along with a column of count (as "count"), try the following adding the following to your search query;

| eventstats sum(count) as total
| eval code_per = round((count / total)*100,2)."%"
| fields - total

View solution in original post

Path Finder

Assuming you have a table reflecting a column of http codes along with a column of count (as "count"), try the following adding the following to your search query;

| eventstats sum(count) as total
| eval code_per = round((count / total)*100,2)."%"
| fields - total

View solution in original post

Path Finder

That didn't completely work for me, but I did use the sum(count) as total which gave me what I was looking for. Thanks!

0 Karma

Path Finder

Copy.

If you want to provide more information we can attempt to work further into making sure it works correctly otherwise I'm glad you were able to make it work and if satisfied, please mark answered 🙂

Have a good day!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!