Hi ,
i am trying to calculate a percentage of status codes over time, but the calculation doesn't sum up to 100% .
Can anyone suggest what i am doing wrong here?
index=idxix_iod sourcetype IN ("prod") status IN(200,201,204,302,400,401,403,404,429,500)
| chart useother=f span=1h count over _time by status
| addtotals| timechart span=1h values(eval(200*100/Total)) AS 200 ,
values(eval(201*100/Total)) AS 201, values(eval(204*100/Total)) AS 204,values(eval(302*100/Total)) AS 302,values(eval(400*100/Total)) AS 400,values(eval(401*100/Total)) AS 401,values(eval(403*100/Total)) AS 403,values(eval(404*100/Total)) AS 404,values(eval(429*100/Total)) AS 429,values(eval(500*100/Total)) AS 500
I think splunk maybe just doing the math exactly as you have typed in the timerchart. Trying wrapping those fields in single quotes.
...| timechart span=1h values(eval('200'*100/Total)) AS 200 ,values(eval('201'*100/Total)) AS 201 .....
I think splunk maybe just doing the math exactly as you have typed in the timerchart. Trying wrapping those fields in single quotes.
...| timechart span=1h values(eval('200'*100/Total)) AS 200 ,values(eval('201'*100/Total)) AS 201 .....
thankyou so much