Splunk Search

Query to display if 500 error http status count is more then 30 percentage of total api calls

Sarvoday
New Member
 
Labels (2)
0 Karma

manjunathmeti
Champion

Use the top command. This adds two fields to the results: count and percent.

| top http_status_field_name

 Then you can filter based on http_status_field_name and percent.

| top http_status_field_name | where http_status_field_name=500 AND percent>30 
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...