Splunk Search

Query - How to check failed % > X

suvi6789
Path Finder

Hi, 
I need help in a splunk search. 
My requirement is get the stats for failed and successful count along with the percentage of Failed and  Successful  and at last I would need to fetch the stats only when the failed % is > 10 %

My query works fine  until the below

index=abcd
| eval status= case(statuscode < 400, "Success", statuscode > 399,"Failed")
| stats count(status) as TOTAL  count(eval(status="Success")) as Success_count  count(eval(status="Failed")) as Failed_count  by Name, URL
| eval Success%= ((Success_count /TOTAL)*100)
| eval Failed%= ((Failed_count /TOTAL)*100)

The above works and I get the table with Name URL TOTAL  Success_count   Failed_count   Success% Failed%

Now, when I add the below to the above query, It fails 
| where Failed% > 10
How do I get the failed% > 10 with the above table. Please assist

Labels (1)
0 Karma
1 Solution

dtburrows3
Builder

I think Splunk can be finicky about some special characters in fieldnames when evaluating logic statements

I think the same applies for fieldnames containing "{" or "}" and maybe even "."

View solution in original post

0 Karma

suvi6789
Path Finder

Many thanks for the update. I will verify and get back to you

0 Karma

dtburrows3
Builder

You may need to put single quotes around your field in the where clause

Example:

| makeresults
    | eval
        "Fail%"=25
    | where 'Fail%'>10
0 Karma

dtburrows3
Builder

I think Splunk can be finicky about some special characters in fieldnames when evaluating logic statements

I think the same applies for fieldnames containing "{" or "}" and maybe even "."

0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

my hint is to use some filenames which don't contains any special marks when you are searching, calculate or manipulate data. If/when you want those "fancy names" on your output it's better to use like

  • rename fooPercent as foo%
  • rename bar as "this is bar"

on last command on your SPL. With this way you will get much easier life with SPL 😉

r. Ismo

suvi6789
Path Finder

Many thanks for all your inputs. It is working as expected

0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...