Splunk Search

% failures for same index

VS0909
Communicator

Need help with a Splunk query  to display % failures for each day during the time range selected, for same index but different search term

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

 

A2= Total number of events returned by the below query:

index="abc"  "searchTermForA2"

 

Expected Output:

-------Date-------|--------A1-------------|------A2----------|-----% failures-------

Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul.

Please help with the query.

Thanks!

0 Karma

venkatasri
SplunkTrust
SplunkTrust

Hi @VS0909 

Can you try this,

index="abc" "searchTermForA1" OR "searchTermForA2" 
| eval e_t=case(match(_raw, "searchTermForA1"), "A", match(_raw, "searchTermForA2"), "B") 
| bin span=1d _time 
| stats count(eval(e_t = "A")) as A1, count(eval(e_t = "B")) as A2 by _time 
| eval fail_perc=(A1/A2) * 100 
| table _time A1 A2 fail_perc

---

An upvote would be appreciated and Accept solution if this reply helps!

0 Karma
Get Updates on the Splunk Community!

Developer Spotlight with Brett Adams

In our third Spotlight feature, we're excited to shine a light on Brett—a Splunk consultant, innovative ...

Index This | What can you do to make 55,555 equal 500?

April 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Say goodbye to manually analyzing phishing and malware threats with Splunk Attack ...

In today’s evolving threat landscape, we understand you’re constantly bombarded with phishing and malware ...