Splunk Search

Splunk qyery for failure status more than 10%?

karthi2809
Communicator

Three type of status:
status:400
status:404
status:500

need total count and status count. if count of status more than 10% need to trigger alert?

Tags (3)
0 Karma
1 Solution

FrankVl
Ultra Champion
| your base search
| stats count AS statuscount by status
| eventstats sum(statuscount) AS totalcount
| eval percentage=statuscount/totalcount*100 
| where percentage > 10

View solution in original post

p_gurav
Champion

You can try :

 index=<your index> | eventstats count as totalcount | chart count,first(totalcount) as totalcount by status | eval percentage=round(count/totalcount*100) | where percentage > 10

FrankVl
Ultra Champion
| your base search
| stats count AS statuscount by status
| eventstats sum(statuscount) AS totalcount
| eval percentage=statuscount/totalcount*100 
| where percentage > 10

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!