Need help with a Splunk query to display % failures
% failures = A1/A2 *100
A1= Total number of events returned by the below query:
index="abc" "searchTermForA1"
A2= Total number of events returned by the below query:
index="xyz" "searchTermForA2"
Please help with the query.
Thanks!
(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2
is not giving the correct count for A1 and A2 , when compared to executing index="abc" "searchTermForA1" and index="xyz" "searchTermForA2" separately.
Need help with a Splunk query to display % failures
% failures = A1/A2 *100
A1= Total number of events returned by the below query:
index="abc" "searchTermForA1"
A2= Total number of events returned by the below query:
index="xyz" "searchTermForA2"
Please help with the query.
Thanks!
(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2
This should work. Can you please try this?
index="abc" "searchTermForA1" | stats count as A1 | appendcols [ search index="xyz" "searchTermForA2"| stats count as A2]
| eval "% failures" = A1/A2 *100
Try something like this.
(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2
| eval "% failures" = A1/A2 *100
@kamlesh_vaghela Thanks for the reply!
But for "A1= count(eval(index="abc"))"
My requirement is A1= Total number of events returned by the below query:
index="abc" "searchTermForA1"
A2= Total number of events returned by the below query:
index="xyz" "searchTermForA2"
A1 and A2 should include count filter by index and search term.
Events are already filtered with
(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
So only index filter is enough to identify events,
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2
So just try and let me know if any issue.
Thanks
KV
▄︻̷̿┻̿═━一 ?
If any of my reply helps you to solve the problem Or gain knowledge, an upvote would be appreciated.