Splunk Search

Splunk Subquery

haiderzada
New Member
Basically, I have a problem in which I want to run two queries the first query will return me the total number of requests and the second query will return requests that fail so that i can calculate the percentage but I am unable to do this with a subquery.
 
Currently, I am using this query
 
"Carrier Failure: provider_name=*" 
| dedup application_id | stats count AS total_carrier_errors
| append
[search host="prod-celery-gateway-0*" sourcetype="supervisor"
"driver dispatch_request: Sending request to" NOT failed
| stats count AS total_requests]
| table total_carrier_errors total_requests
| eval carrier_errors_percent=(total_carrier_errors/total_requests*100)

Can anyone guide me with this?

Thank You!

Labels (2)
0 Karma

kennetkline
Path Finder

Is there a specifics source type the the first one can be referenced against?

I find the following approach to work best:  I write two independent searches  to bring the datasets we want.

Write a search to do an OR statement   ((Search1 ) OR (Search2 )) pipe to stats  I have done counts against matches on sourcetype.  In your example I don't know if the first search as an exact sourcetype.  I did example stating "firstsourcetype" as a variable to replace twice in the search with the actual sourcetype to be used:

The following search is intended to search both searches and then | stats (count matches by sourcetype or no by clause as necessary based on objective, then do the eval then table

( sourcetype="firstsourcetype" "Carrier Failure: provider_name=*" ) OR
( sourcetype="supervisor" host="prod-celery-gateway-0*" "driver dispatch_request: Sending request to" NOT failed )
| stats count(eval(LIKE(sourcetype,"firstsourcetype"))) as total_carrier_errors, count(eval(LIKE(sourcetype,"supervisor"))) as total_requests
| eval carrier_errors_percent=(total_carrier_errors/total_requests*100)
| table total_carrier_errors total_requests

0 Karma

isoutamo
SplunkTrust
SplunkTrust
0 Karma

haiderzada
New Member

No this will not help me. Actually, my problem is different from this one I want to run two separate queries one will return me the total number of requests and the second query will return me the number of the failed requests and then I want to calculate the percentage based on these two returned values.

0 Karma
Get Updates on the Splunk Community!

Aligning Observability Costs with Business Value: Practical Strategies

 Join us for an engaging Tech Talk on Aligning Observability Costs with Business Value: Practical ...

Mastering Data Pipelines: Unlocking Value with Splunk

 In today's AI-driven world, organizations must balance the challenges of managing the explosion of data with ...

Splunk Up Your Game: Why It's Time to Embrace Python 3.9+ and OpenSSL 3.0

Did you know that for Splunk Enterprise 9.4, Python 3.9 is the default interpreter? This shift is not just a ...