About vinothkumark

bowesmana

The eventstats should be | eventstats sum(eval(if(return_code<=200, count, 0))) as OK, sum(eval(if(return_code>200, count, 0))) as KO | eval pctKO = (KO * 100) / (OK + KO) however, with your calculations this actually is 3.99%... | makeresults | eval x=split("100:254,200:227,404:8,404:3,406:9", ",") | mvexpand x | rex field=x "(?<return_code>\d+):(?<count>\d+)" | table return_code count | eventstats sum(eval(if(return_code<=200, count, 0))) as OK, sum(eval(if(return_code>200, count, 0))) as KO | eval pctKO = (KO * 100) / (OK + KO)

gcusello

Hi @vinothkumark, it should correctly run, please debug it using one by one the conditions. Ciao. Giuseppe

fredclown

This should work with decimals and non-numeric characters. | makeresults | eval A = "10.5% sdfgdsfgjlk" | eval B = "20.2% gdsfdf" ```The stuff above is just to get sone sample data``` | eval C = tonumber(replace(A,"[^0-9\.]+","")) + tonumber(replace(B,"[^0-9\.]+","")) . "%"

vinothkumark

Hi, can you help on the query if multiple condition needs to be met in the same query? Example: status code is 500 and greater than 10% alert should be triggered. also, if status code is 403 and greater than 20% alert should be triggered.

vinothkumark

Hi, can you help on the query if multiple condition needs to be met in the same query? Example: status code is 500 and greater than 10% alert should be triggered. also, if status code is 403 and greater than 20% alert should be triggered.

Posts	9
Solutions	0
Karma Given	4
Karma Received	0
Member Since	‎12-14-2021

Online Status	Offline
Date Last Visited	2 weeks ago

How to find percentage with selective sum of field...

How to create Splunk single alert for multiple htt...

How to add two field values into new field?

Re: how to find percentage with selective sum of f...

Re: Splunk single alert for multiple http status c...

Re: How to add two field values into new field?

Re: How to alert when statusCode=403 is over X per...

Re: Splunk alert based on HTTP status codes