Splunk Search

Percent of Error Help

jbouch03
Path Finder

I am relatively new to Splunk and I am trying to create a percent of error metric. I have two log sources that have a common field named title. One log contains that amount of images processed, while the other processes the number of errors. I am trying to correlate the logs together and output a table that shows the percentage of errors compared to the number processed.

My query looks like this so far:

sourcetype="processed" OR sourcetype="error" | transaction maxspan=1d Title connected=f

after this I'm stuck. Can some one please help me out

0 Karma
1 Solution

lguinn2
Legend

Since we can't see the data, what you want is a bit unclear. But, try this

sourcetype="processed" OR sourcetype="error"
| stats count(eval(sourcetype="processed")) as Successful count(eval(sourcetype="error"))  as Error by Title
| eval Total = Error + Successful
| eval PercentSuccessful = round(Successful * 100 / Total, 2)
| eval PercentErrors = round(Errors * 100 / Total, 2)
| table Title Total Successful Error PercentSuccessful PercentErrors

Also, this will be a lot faster than the transaction command.

View solution in original post

0 Karma

lguinn2
Legend

Since we can't see the data, what you want is a bit unclear. But, try this

sourcetype="processed" OR sourcetype="error"
| stats count(eval(sourcetype="processed")) as Successful count(eval(sourcetype="error"))  as Error by Title
| eval Total = Error + Successful
| eval PercentSuccessful = round(Successful * 100 / Total, 2)
| eval PercentErrors = round(Errors * 100 / Total, 2)
| table Title Total Successful Error PercentSuccessful PercentErrors

Also, this will be a lot faster than the transaction command.

0 Karma

jbouch03
Path Finder

Thanks for the reply. Sorry I couldn't add data to the explanation but its confidential in nature. I tried your query and it worked, but I had just finished a similar query that just got the percentage information. I used the following query (PatientID was the title):

sourcetype="processed" | stats count as Proc | join type=outer max=0 overwrite=false PatientID [search sourcetype="error" | stats count as Err] | eval percent_difference=((Err/Proc)*100) | eval percent_difference=round(percent_difference,0) | table percent_difference

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...