Splunk Search

Query to display if 500 error http status count is more then 30 percentage of total api calls

Sarvoday
New Member
 
Labels (2)
0 Karma

manjunathmeti
SplunkTrust
SplunkTrust

Use the top command. This adds two fields to the results: count and percent.

| top http_status_field_name

 Then you can filter based on http_status_field_name and percent.

| top http_status_field_name | where http_status_field_name=500 AND percent>30 
0 Karma
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>