Splunk Search

Query to get top 5 failures

Observer

I have events being sent to Splunk which will have the following fields
MsgID, Status(Failure/Success)
I need to get the list of top 5 MsgIDs with maximum failures. And display each of the 5 MsgIDs in a pie chart, with success and failure percentages.

I am able to get the top 5 failures, but unable to figure out how to get both success and faliures as percentages for top 5 failures.
Please help

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

This query will give you successes and failures as percentages, but I don't know a way to get both into the same pie chart.

... | stats count as Total, count(eval(Status=="Failure")) as Failures, count(eval(Status=="Success")) as Successes by MsgID
| sort 5 - Failures
| eval PctFailure = Failures * 100 / Total, PctSuccess = Successes * 100 / Total
| chart PctFailure by MsgID
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

This query will give you successes and failures as percentages, but I don't know a way to get both into the same pie chart.

... | stats count as Total, count(eval(Status=="Failure")) as Failures, count(eval(Status=="Success")) as Successes by MsgID
| sort 5 - Failures
| eval PctFailure = Failures * 100 / Total, PctSuccess = Successes * 100 / Total
| chart PctFailure by MsgID
---
If this reply helps you, an upvote would be appreciated.

View solution in original post

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!