Splunk Search

% failures for same index


Need help with a Splunk query  to display % failures for each day during the time range selected, for same index but different search term

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"


A2= Total number of events returned by the below query:

index="abc"  "searchTermForA2"


Expected Output:

-------Date-------|--------A1-------------|------A2----------|-----% failures-------

Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul.

Please help with the query.


0 Karma


Hi @VS0909 

Can you try this,

index="abc" "searchTermForA1" OR "searchTermForA2" 
| eval e_t=case(match(_raw, "searchTermForA1"), "A", match(_raw, "searchTermForA2"), "B") 
| bin span=1d _time 
| stats count(eval(e_t = "A")) as A1, count(eval(e_t = "B")) as A2 by _time 
| eval fail_perc=(A1/A2) * 100 
| table _time A1 A2 fail_perc


An upvote would be appreciated and Accept solution if this reply helps!

0 Karma
Get Updates on the Splunk Community!

Observability | How to Think About Instrumentation Overhead (White Paper)

Novice observability practitioners are often overly obsessed with performance. They might approach ...

Cloud Platform | Get Resiliency in the Cloud Event (Register Now!)

IDC Report: Enterprises Gain Higher Efficiency and Resiliency With Migration to Cloud  Today many enterprises ...

The Great Resilience Quest: 10th Leaderboard Update

The tenth leaderboard update (11.23-12.05) for The Great Resilience Quest is out >> As our brave ...