Splunk Search

how to calculate the Success events percentage based on the time intervals.

mvaradarajam
Path Finder

Hi All,

how to calculate percentage value based on time intervals.here i am writting a query

index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="Success"
| timechart span=1d count(DashboardStatus) as Success by sourcetype
| appendcols
[ search index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="*"
| bucket _time span=1d
|stats count(eval(eventtype="YViewStatus" OR eventtype="SViewStatus")) as ClientSuccess count(DashboardStatus) as complete by _time
| eval percent=(ClientSuccess*100/complete)
|table percent
]

Here "YViewStatus" is the event type,it display the success records.
"DashboardStatus" is the field type (Success/Failed).we are calculating the percentage based on the Success/Total events.
using the above query there is a mismatch b/w time intervals,can u plz suggest the right query.
thanks for advance.

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

The appendcols do not insure that the exact same time range from the 2 searches will match.
you should use a bucket _time span and join them on the field _time.

Instead of |appendcols [, use | join _time [

Also you are using 2 searches (one for success, one for all dashboard and stats), you could try to use only one
please try with something like :

index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="*"
| bucket _time span=1d |
| stats count(eval(DashboardStatus="Success")) AS Success count(eval(eventtype="YViewStatus" OR eventtype="SViewStatus")) AS ClientSuccess count(DashboardStatus) AS complete by _time sourcetype
| eval percent=(ClientSuccess*100/complete)

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...