Splunk Search

Splunk qyery for failure status more than 10%?

Communicator

Three type of status:
status:400
status:404
status:500

need total count and status count. if count of status more than 10% need to trigger alert?

Tags (3)
0 Karma
1 Solution

Ultra Champion
| your base search
| stats count AS statuscount by status
| eventstats sum(statuscount) AS totalcount
| eval percentage=statuscount/totalcount*100 
| where percentage > 10

View solution in original post

Champion

You can try :

 index=<your index> | eventstats count as totalcount | chart count,first(totalcount) as totalcount by status | eval percentage=round(count/totalcount*100) | where percentage > 10

Ultra Champion
| your base search
| stats count AS statuscount by status
| eventstats sum(statuscount) AS totalcount
| eval percentage=statuscount/totalcount*100 
| where percentage > 10

View solution in original post