Splunk Search

calculating field percentages before stats command

amerineni
Loves-to-Learn

index= base search | stats count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError

 

is there anyway i can calculate the success percent of each requestName field based on HttpStatus values(<299 success and >299 failure) before executing stats command and then include that in the result table?

 

Appreciate any help.

Labels (1)
0 Karma

isoutamo
SplunkTrust
SplunkTrust

Hi

You could try this:

index=base search 
| eval h_ok=if(HttpStatus < 299, 1, 0)
| eval h_nok=if(HttpStatus > 299, 1, 0)
| stats sum(h_ok) as h_ok, sum(h_nok) as h_nok, count, avg(ElapsedTime) as duration,  by requestName, LogType, errorMessage, HttpStatus, isValidError
| eval h_per_ok = round(h_ok/(h_ok + h_nok),2)*100, h_per_nok = round(h_nok/(h_ok+h_nok),2)
| table h_per_ok, h_per_nok, requestName, ....
0 Karma

amerineni
Loves-to-Learn

thanks for the quick response. 

My data looks like this

requestName1     logType1  errorMessage1

requestName1     logType1  errorMessage2

the query you suggested returns different success percent for the above two combinations. However i want to populate a column with total success percent for "request1" not individual combinations success percents. Hope explained what i need correctly. 

 

I'm doing a sub query to calculate to percentages and then joining now. Wanted to know if there is a better way. Thanks.

 

0 Karma

anmolpatel
Builder

@amerineni  this should provide the guidance on what you need

| makeresults
| eval _raw="HttpStatus, isValidError
200, false
200, false
201, false
305, true
202, false
400, true
500, true"
| multikv forceheader=1
| rename COMMENT AS "CHECK THE CODE FROM HERE ON"
| eval result = if(HttpStatus < 299, 1, 0)
| eventstats count as TotalSuccessFailure by result
| eventstats count as TotalEvents
| eval percent = round((TotalSuccessFailure / TotalEvents) * 100,1)
| rename COMMENT AS "CHECK THE CODE ABOVE HERE"
| fields HttpStatus result TotalSuccessFailure TotalEvents percent

 

you can than take it further and just get the score by using stats

| stats values(percent) by result

 

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In December, the Splunk Threat Research Team had 1 release of new security content via the Enterprise Security ...

Why am I not seeing the finding in Splunk Enterprise Security Analyst Queue?

(This is the first of a series of 2 blogs). Splunk Enterprise Security is a fantastic tool that offers robust ...

Index This | What are the 12 Days of Splunk-mas?

December 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...