Splunk Search

Query to display if 500 error http status count is more then 30 percentage of total api calls

Sarvoday
New Member
 
Labels (2)
0 Karma

manjunathmeti
Champion

Use the top command. This adds two fields to the results: count and percent.

| top http_status_field_name

 Then you can filter based on http_status_field_name and percent.

| top http_status_field_name | where http_status_field_name=500 AND percent>30 
0 Karma
Get Updates on the Splunk Community!

The All New Performance Insights for Splunk

Splunk gives you amazing tools to analyze system data and make business-critical decisions, react to issues, ...

Good Sourcetype Naming

When it comes to getting data in, one of the earliest decisions made is what to use as a sourcetype. Often, ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...