Splunk Search

stats count by field and show total

sarit_s
Communicator

Hello,

I want to calculate the count of total events, count of errors and show the total percent of the failures from total.

my query is : 

sourcetype=WalletExecuter Exception.Message="* BitGo *" 
|stats count as total count(eval(Level="Error")) as FAILRUES by Exception.CorrelationId
| eval Failure%=round((FAILRUES/total)*100, 2) 

but the results that returned are the percent of each CorrelationId
how can i show the total failure percent ?

thanks

Labels (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Is this what you mean?

sourcetype=WalletExecuter Exception.Message="* BitGo *" 
|stats count as total count(eval(Level="Error")) as FAILRUES by Exception.CorrelationId
| eventstats sum(total) as grandtotal
| eval Failure%=round((FAILRUES/grandtotal)*100, 2) 
0 Karma

sarit_s
Communicator

Hey,

No.. i need total of all the correlationId in one line

this is the results of the query you sent:

sarit_s_0-1641732182495.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Sorry, I don't understand what you results you are expecting. Do you mean addcoltotals?

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...