Percent of Error Help

[jbouch03]

I am relatively new to Splunk and I am trying to create a percent of error metric. I have two log sources that have a common field named title. One log contains that amount of images processed, while the other processes the number of errors. I am trying to correlate the logs together and output a table that shows the percentage of errors compared to the number processed.

My query looks like this so far:

sourcetype="processed" OR sourcetype="error" | transaction maxspan=1d Title connected=f

after this I'm stuck. Can some one please help me out

[lguinn2 · Accepted solution]

Since we can't see the data, what you want is a bit unclear. But, try this

sourcetype="processed" OR sourcetype="error"
| stats count(eval(sourcetype="processed")) as Successful count(eval(sourcetype="error"))  as Error by Title
| eval Total = Error + Successful
| eval PercentSuccessful = round(Successful * 100 / Total, 2)
| eval PercentErrors = round(Errors * 100 / Total, 2)
| table Title Total Successful Error PercentSuccessful PercentErrors

Also, this will be a lot faster than the transaction command.

[jbouch03]

Thanks for the reply. Sorry I couldn't add data to the explanation but its confidential in nature. I tried your query and it worked, but I had just finished a similar query that just got the percentage information. I used the following query (PatientID was the title):

sourcetype="processed" | stats count as Proc | join type=outer max=0 overwrite=false PatientID [search sourcetype="error" | stats count as Err] | eval percent_difference=((Err/Proc)*100) | eval percent_difference=round(percent_difference,0) | table percent_difference