Splunk Search

calculating field percentages before stats command

amerineni
Loves-to-Learn

index= base search | stats count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError

 

is there anyway i can calculate the success percent of each requestName field based on HttpStatus values(<299 success and >299 failure) before executing stats command and then include that in the result table?

 

Appreciate any help.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try this:

index=base search 
| eval h_ok=if(HttpStatus < 299, 1, 0)
| eval h_nok=if(HttpStatus > 299, 1, 0)
| stats sum(h_ok) as h_ok, sum(h_nok) as h_nok, count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError
| eval h_per_ok = round(h_ok/(h_ok + h_nok),2)*100, h_per_nok = round(h_nok/(h_ok+h_nok),2)
| table h_per_ok, h_per_nok, requestName, ....
0 Karma

amerineni
Loves-to-Learn

thanks for the quick response. 

My data looks like this

requestName1     logType1  errorMessage1

requestName1     logType1  errorMessage2

the query you suggested returns different success percent for the above two combinations. However i want to populate a column with total success percent for "request1" not individual combinations success percents. Hope explained what i need correctly. 

 

I'm doing a sub query to calculate to percentages and then joining now. Wanted to know if there is a better way. Thanks.

 

0 Karma

anmolpatel
Builder

@amerineni  this should provide the guidance on what you need

| makeresults
| eval _raw="HttpStatus, isValidError
200, false
200, false
201, false
305, true
202, false
400, true
500, true"
| multikv forceheader=1
| rename COMMENT AS "CHECK THE CODE FROM HERE ON"
| eval result = if(HttpStatus < 299, 1, 0)
| eventstats count as TotalSuccessFailure by result
| eventstats count as TotalEvents
| eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1)
| rename COMMENT AS "CHECK THE CODE ABOVE HERE"
| fields HttpStatus result TotalSuccessFailure TotalEvents percent

 

you can than take it further and just get the score by using stats

| stats values(percent) by result

 

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...