Splunk Search

How to make timechart with ratio failed/total ?

AnaSpiStats
Engager

This is my search:

message_data_type=gd*| timechart count by message_data_type limit=10

These are my results:

AnaSpiStats_0-1684848039033.png

But I need to create a timechart of the  failed/total events ratio.

How can I do that ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| timechart count by message_data_type
| addtotals col=f row=t
| eval failedratio=failed/Total
| fields _time failedratio Total

View solution in original post

AnaSpiStats
Engager

failed/Total events 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart count by message_data_type
| addtotals col=f row=t
| eval failedratio=failed/Total
| fields _time failedratio Total

ITWhisperer
SplunkTrust
SplunkTrust

Is that what you really want to do? What if there are zero failed events - Success/zero is infinity, or Failed/zero is infinity if there are zero Success events?

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...