Splunk Search

show precent of http errors

jrich523
Path Finder

I saw a decent amount of questions about similar stuff, but i wasnt able to make it happen.

I have a field that is http-status and i want the percent of http-status > 499 of total

Tags (3)
0 Karma
1 Solution

somesoni2
Revered Legend

Try following

<your base search which gives http_status field> | stats count as total, count(eval(tonumber(http_status)>499)) as total499plushttpstatus | eval percHttpStatus499Plus = (total499plushttpstatus*100)/total

View solution in original post

somesoni2
Revered Legend

Try following

<your base search which gives http_status field> | stats count as total, count(eval(tonumber(http_status)>499)) as total499plushttpstatus | eval percHttpStatus499Plus = (total499plushttpstatus*100)/total
Get Updates on the Splunk Community!

Splunk ITSI & Correlated Network Visibility

  Now On Demand   Take Your Network Visibility to the Next Level In today’s complex IT environments, ...

Community Content Calendar, August edition

In the dynamic world of cybersecurity, staying ahead means constantly solving new puzzles and optimizing your ...

Pro Tips for First-Time .conf Attendees: Advice from SplunkTrust

Heading to your first .Conf? You’re in for an unforgettable ride — learning, networking, swag collecting, ...