Splunk Search

get percentage of specific field over volume

New Member

I have two query

1: sourcetype=A error=499
2: sourcetype=B X=*

I would like to make timechart of % of A on B.

Basically I want to make timechart that will tell if error code increase is because of volume decrease etc,

0 Karma

Ultra Champion
( sourcetype=A error=499) OR (sourcetype=B X=*)
| timechart count by sourcetype
| eval perc= round(A / B * 100,2)
| fillnull
0 Karma
Get Updates on the Splunk Community!

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...

Observability Highlights | November 2022 Newsletter

 November 2022Observability CloudEnd Of Support Extension for SignalFx Smart AgentSplunk is extending the End ...