Splunk Search

calculating field percentages before stats command

amerineni
Loves-to-Learn

index= base search | stats count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError

 

is there anyway i can calculate the success percent of each requestName field based on HttpStatus values(<299 success and >299 failure) before executing stats command and then include that in the result table?

 

Appreciate any help.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try this:

index=base search 
| eval h_ok=if(HttpStatus < 299, 1, 0)
| eval h_nok=if(HttpStatus > 299, 1, 0)
| stats sum(h_ok) as h_ok, sum(h_nok) as h_nok, count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError
| eval h_per_ok = round(h_ok/(h_ok + h_nok),2)*100, h_per_nok = round(h_nok/(h_ok+h_nok),2)
| table h_per_ok, h_per_nok, requestName, ....
0 Karma

amerineni
Loves-to-Learn

thanks for the quick response. 

My data looks like this

requestName1     logType1  errorMessage1

requestName1     logType1  errorMessage2

the query you suggested returns different success percent for the above two combinations. However i want to populate a column with total success percent for "request1" not individual combinations success percents. Hope explained what i need correctly. 

 

I'm doing a sub query to calculate to percentages and then joining now. Wanted to know if there is a better way. Thanks.

 

0 Karma

anmolpatel
Builder

@amerineni  this should provide the guidance on what you need

| makeresults
| eval _raw="HttpStatus, isValidError
200, false
200, false
201, false
305, true
202, false
400, true
500, true"
| multikv forceheader=1
| rename COMMENT AS "CHECK THE CODE FROM HERE ON"
| eval result = if(HttpStatus < 299, 1, 0)
| eventstats count as TotalSuccessFailure by result
| eventstats count as TotalEvents
| eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1)
| rename COMMENT AS "CHECK THE CODE ABOVE HERE"
| fields HttpStatus result TotalSuccessFailure TotalEvents percent

 

you can than take it further and just get the score by using stats

| stats values(percent) by result

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...