Splunk Search

Query - How to check failed % > X

suvi6789
Path Finder

Hi, 
I need help in a splunk search. 
My requirement is get the stats for failed and successful count along with the percentage of Failed and  Successful  and at last I would need to fetch the stats only when the failed % is > 10 %

My query works fine  until the below

index=abcd
| eval status= case(statuscode < 400, "Success", statuscode > 399,"Failed")
| stats count(status) as TOTAL  count(eval(status="Success")) as Success_count  count(eval(status="Failed")) as Failed_count  by Name, URL
| eval Success%= ((Success_count /TOTAL)*100)
| eval Failed%= ((Failed_count /TOTAL)*100)

The above works and I get the table with Name URL TOTAL  Success_count   Failed_count   Success% Failed%

Now, when I add the below to the above query, It fails 
| where Failed% > 10
How do I get the failed% > 10 with the above table. Please assist

Labels (1)
0 Karma
1 Solution

dtburrows3
Builder

I think Splunk can be finicky about some special characters in fieldnames when evaluating logic statements

I think the same applies for fieldnames containing "{" or "}" and maybe even "."

View solution in original post

0 Karma

suvi6789
Path Finder

Many thanks for the update. I will verify and get back to you

0 Karma

dtburrows3
Builder

You may need to put single quotes around your field in the where clause

Example:

| makeresults
    | eval
        "Fail%"=25
    | where 'Fail%'>10
0 Karma

dtburrows3
Builder

I think Splunk can be finicky about some special characters in fieldnames when evaluating logic statements

I think the same applies for fieldnames containing "{" or "}" and maybe even "."

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

my hint is to use some filenames which don't contains any special marks when you are searching, calculate or manipulate data. If/when you want those "fancy names" on your output it's better to use like

  • rename fooPercent as foo%
  • rename bar as "this is bar"

on last command on your SPL. With this way you will get much easier life with SPL 😉

r. Ismo

suvi6789
Path Finder

Many thanks for all your inputs. It is working as expected

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...