Splunk qyery for failure status more than 10%?

[karthi2809]

Three type of status:
status:400
status:404
status:500

need total count and status count. if count of status more than 10% need to trigger alert?

[p_gurav]

You can try :

 index=<your index> | eventstats count as totalcount | chart count,first(totalcount) as totalcount by status | eval percentage=round(count/totalcount*100) | where percentage > 10

[FrankVl · Accepted solution]

| your base search
| stats count AS statuscount by status
| eventstats sum(statuscount) AS totalcount
| eval percentage=statuscount/totalcount*100 
| where percentage > 10