Splunk Search

eval percentage issue

Explorer

I am trying to create an error percent tracker, but I cant get the eval command to generate a number. I have tried several search strings, these two seem to be the closest to success.

index="java" host="*tkn*" proxy\/listing | stats count as total | append [search index="java" host="*tkn*" proxy\/listing eventtype="java_exception*" OR eventtype="nix_errors" | stats count as error] | eval error_percentage=100*round(error/success,4) | fields error_percentage,error,total | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0

index="java" host="*tkn*" proxy\/listing | stats count as total | search eventtype="java_exception*" OR eventtype="nix_errors" | stats count as error | eval error_percentage=100*round(error/success,4) | fields error_percentage | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0
Tags (1)
0 Karma

Explorer

Success was a typo from the opposite query, was suppose to be total. The below answers all worked perfectly, thank you for the help

0 Karma

Champion

How do you get the value of success? With a append statement u wont be able to combine it to single event right?

0 Karma

SplunkTrust
SplunkTrust

I'm guessing you want to know what percentage of events from your base search have one of those two eventtypes?

Try something like this:

base search | stats count as total count(eval(match(eventtype, "^java_exception") OR eventtype="nix_errors")) as errors | eval error_percentage=100*round(errors/total,4)

If you like, you can pull the definition of what constitutes an error out of the stats, to get something like this:

base search | eval error=if(match(eventtype, "^java_exception") OR eventtype="nix_errors",1,0) | stats count as total sum(error) as errors | eval error_percentage=100*round(errors/total,4)

Revered Legend

Try following

index="java" host="tkn" proxy/listing | eval hasError=if(eventtype="java_exception" OR eventtype="nix_errors","yes","no") | stats count(eval(hasError="yes")) as error, count as total | eval error_percentage=round(error*100/total,4) | rangemap field=error_percentage low=0-5 elevated=5-10 severe=10-100 default=0
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!