Splunk Search

Plot error % as timeseries

sudhakar_mnsr
New Member

How to plot http error % as timeseries? (when I add _time or timeseries count Iam getting DAG: Execution exception (search cancelled)).

Query:

index=abc source=efg cdn=pqr "message.reqHost"="*xyz*" earliest=-15m latest=now

| eventstats count As Total

| eval Status=case(like(dm_status,"4%"),"HTTPERR", like(dm_status,"5%"),"HTTPERR") | stats count AS ERR_Count by Status, Total

| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)

| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE)

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Can you share the search that doesn't work as well as the one that does?

0 Karma

sudhakar_mnsr
New Member

Thanks for looking into this. Please find the query that give error

 

index=abc source=efg dm_cdn=pqr "message.reqHost"=xyz earliest=-15m latest=now

| eventstats count As Total

| eval Status=case(like(dm_status,"4%"),"HTTP4XX")| stats count AS ERR_Count by Status, Total, _time

| eval ERR_PERCENTAGE=round(((ERR_Count)/Total)*100,2)

| eval ERR_PERCENTAGE = if(isnull(ERR_PERCENTAGE),"0",ERR_PERCENTAGE) | fields _time, ERR_PERCENTAGE

| timechart span=10s count by ERR_PERCENTAGE

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Which version of splunk are you using? Is there any useful information in the job inspector?

0 Karma

sudhakar_mnsr
New Member

Splunk Cloud (Version:8.2.2105.2).

Iam new to Splunk, if you can help me to get the information you are looking for, I can send it. However in verbose mode (events) I could not get any information.

0 Karma
Get Updates on the Splunk Community!

Splunk Enterprise Security 8.0.2 Availability: On cloud and On-premise!

A few months ago, we released Splunk Enterprise Security 8.0 for our cloud customers. Today, we are excited to ...

Logs to Metrics

Logs and Metrics Logs are generally unstructured text or structured events emitted by applications and written ...

Developer Spotlight with Paul Stout

Welcome to our very first developer spotlight release series where we'll feature some awesome Splunk ...