Need help with a Splunk query to display % failures for each day during the time range selected, for same index but different search term
% failures = A1/A2 *100
A1= Total number of events returned by the below query:
index="abc" "searchTermForA1"
A2= Total number of events returned by the below query:
index="abc" "searchTermForA2"
Expected Output:
-------Date-------|--------A1-------------|------A2----------|-----% failures-------
Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul.
Please help with the query.
Thanks!
Hi @VS0909
Can you try this,
index="abc" "searchTermForA1" OR "searchTermForA2"
| eval e_t=case(match(_raw, "searchTermForA1"), "A", match(_raw, "searchTermForA2"), "B")
| bin span=1d _time
| stats count(eval(e_t = "A")) as A1, count(eval(e_t = "B")) as A2 by _time
| eval fail_perc=(A1/A2) * 100
| table _time A1 A2 fail_perc
---
An upvote would be appreciated and Accept solution if this reply helps!