Splunk Search

% failures for each day during the time range selected

VS0909
Communicator

Need help with a Splunk query  to display % failures for each day during the time range selected

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

 

A2= Total number of events returned by the below query:

index="xyz"  "searchTermForA2"

 

Expected Output:

-------Date-------|--------A1-------------|------A2----------|-----% failures-------

Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul.

Please help with the query.

Thanks!

Labels (6)
0 Karma

VS0909
Communicator

@ITWhisperer  Thanks for the reply! 

I also have a scenario where I need to find % failure for each day during the time range selected, for same index but different search term

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

 

A2= Total number of events returned by the below query:

index="abc"  "searchTermForA2"

Please help.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

It will depend on what "searchTermForA1" and "searchTermForA2" actually are and possibly what your events actually look like

0 Karma

VS0909
Communicator

@ITWhisperer   

searchTermForA1 = "A1_API_Failed"

searchTermForA2="TESTSTRING" "https://aaa.com/v1/?bbb"

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="abc" "searchTermForA1"
| bin _time span=1d
| stats count as A1 by _time
| append [| search index="abc" "searchTermForA2"
     | bin _time span=1d
     | stats count as A2 by _time
     ]
| stats values(*) as * by _time
| eval failures=100*A1/A2

ITWhisperer
SplunkTrust
SplunkTrust
(index="abc" "searchTermForA1") OR (index="xyz" "searchTermForA2")
| bin _time span=1d
| stats count(eval(index="abc")) as A1 count(eval(index="xyz")) as A2 by _time
| eval failures=100*A1/A2
Get Updates on the Splunk Community!

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...