Splunk Search

extract percentage of code by servername

indeed_2000
Motivator

Hi
i have two field "servername" "code". i need to extract percent of code by servers.

index="my-index" | table servername code

expected output:
servername code percent count
server1           404    50%        50
                              500    40%       40
                              401    10%       10
server2           404     55%       55
                              500     30%       30
                              401    15%       15

any idea?
thanks

Labels (5)
0 Karma
1 Solution

indeed_2000
Motivator

after several try finally find solution, here is the solution:

index="my-index" err* |

| fields code, servername
| stats count(code) as totalCount by servername, code
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerServer by servername
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerServer=round((totalCount/_totalPerServer)*100,2)
| stats list(code) as code list(precentagePerServer) as percentageTotal list(totalCount) by servername
| sort - totalCount

View solution in original post

0 Karma

efavreau
Motivator

@indeed_2000It looks like the solution you posted and accepted uses the code from the page I linked to. Glad it helped you. It looks like you've found that lines of SPL code may be useful for multiple use cases.
If the pointer I provided was helpful, a karma thumbs up is appreciated.
Happy Splunking!

###

If this reply helps you, an upvote would be appreciated.
0 Karma

indeed_2000
Motivator

after several try finally find solution, here is the solution:

index="my-index" err* |

| fields code, servername
| stats count(code) as totalCount by servername, code
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerServer by servername
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerServer=round((totalCount/_totalPerServer)*100,2)
| stats list(code) as code list(precentagePerServer) as percentageTotal list(totalCount) by servername
| sort - totalCount

0 Karma

efavreau
Motivator

Hi @indeed_2000 ! It's often a good idea to search the community for answers before asking the question. In this case, I found exactly an answer in only one search:

https://community.splunk.com/t5/Splunk-Search/How-to-get-the-percentage-of-each-HTTP-status-code/td-...

If this resolves your problem, please accept this answer.

###

If this reply helps you, an upvote would be appreciated.
0 Karma

indeed_2000
Motivator

the question that you mention is different that with my question.

any idea?

thanks

 

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...