Splunk Search

show precent of http errors

jrich523
Path Finder

I saw a decent amount of questions about similar stuff, but i wasnt able to make it happen.

I have a field that is http-status and i want the percent of http-status > 499 of total

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try following

<your base search which gives http_status field> | stats count as total, count(eval(tonumber(http_status)>499)) as total499plushttpstatus | eval percHttpStatus499Plus = (total499plushttpstatus*100)/total

View solution in original post

somesoni2
Revered Legend

Try following

<your base search which gives http_status field> | stats count as total, count(eval(tonumber(http_status)>499)) as total499plushttpstatus | eval percHttpStatus499Plus = (total499plushttpstatus*100)/total

View solution in original post

Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!