Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
×
Are you a member of the Splunk Community?
Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
- Find Answers
- :
- About Nafees
Nafees
Explorer
Member since:
03-10-2023
03-13-2023
Community Statistics
| Posts | 7 |
| Solutions | 0 |
| Karma Given | 2 |
| Karma Received | 0 |
| Member Since | 03-10-2023 |
Activity Feed
- Karma Re: Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename speci for gcusello. 03-13-2023 12:47 AM
- Posted Re: Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename speci on Monitoring Splunk. 03-13-2023 12:46 AM
- Posted Re: Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename speci on Monitoring Splunk. 03-13-2023 12:38 AM
- Posted Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename specifier on Monitoring Splunk. 03-13-2023 12:25 AM
- Karma Re: Error in 'eval' command: The expression is malformed. Expected IN. for gcusello. 03-10-2023 03:25 AM
- Posted Re: Error in 'eval' command: The expression is malformed. Expected IN. on Monitoring Splunk. 03-10-2023 03:24 AM
- Posted Re: Error in 'eval' command: The expression is malformed. Expected IN. on Monitoring Splunk. 03-10-2023 03:23 AM
- Posted Re: Error in 'eval' command: The expression is malformed. Expected IN. on Monitoring Splunk. 03-10-2023 02:47 AM
- Tagged Error in 'eval' command: The expression is malformed. Expected IN. on Monitoring Splunk. 03-10-2023 12:49 AM
- Tagged Error in 'eval' command: The expression is malformed. Expected IN. on Monitoring Splunk. 03-10-2023 12:49 AM
- Posted Error in 'eval' command: The expression is malformed. Expected IN. on Monitoring Splunk. 03-10-2023 12:47 AM
Topics I've Started
| Subject | Karma | Author | Latest Post |
|---|---|---|---|
| 0 | |||
| 0 |
03-13-2023
12:46 AM
yes @gcusello , my apologies. Its working fine, I got confused at the start but when I tried this, it is working now. Thanks for your help as always. 🙂 One more Karma is on its way for you !!! 🙂
... View more
03-13-2023
12:38 AM
Hi @gcusello , thanks for response, but I want to show Total, Success and Success Rate in one table which is grouped by the customers. How to do that then?
... View more
03-13-2023
12:25 AM
Hi There, I am running below query, base search | rename msg.message as "message", msg.customer as "customer" | stats count as Total, count(eval(isnull(msg.errorCode))) as Success, count(eval(isnotnull(msg.errorCode))) as Error, eval(((Success/Total)*100)."%") as SuccessRate by customer and I am getting below error. Error in 'stats' command: The number of wildcards between field specifier '((Success/Total)*100).%' and rename specifier 'SuccessRate' do not match. Note: empty field specifiers implies all fields, e.g. sum() == sum(*). Can anyone please tell me where I am wrong? basically I want to calculate a percent of total successful events here. Thanks!!!
... View more
Labels
- Labels:
-
search head
03-10-2023
03:24 AM
Sure @PickleRick , thank you for your help !!!
... View more
03-10-2023
03:23 AM
Sure, Thank you @gcusello for the help !!!
... View more
03-10-2023
02:47 AM
Thank You so much @gcusello for the response. Actually what I am trying to do is, when the base search matches, the Total_Count should always get a value, basically here I want to count the total number of events and then the Total_Success and Total_Error should only be counted if their respective conditions are true. And then I want to calculate the rate of success by putting the event counts. Basically what I want to do it something like this (total success events/total events)*100 that is the reason I gave "1"s to all the events and then sum it up at the last to get the total event count. That is the reason I gave Total_Count a "1" for each event, and then I applied a sum for that to get the total events count. But I think this approach is not correct right? I think the solution which you provided at the last answers this question and I can write my query as follows base search
| rename
msg.message AS "message",
msg.customer AS "customer"
| stats
count as Total,
count(eval(isnull(msg.errorCode)) AS Success,
count(eval(isnotnull(msg.errorCode)) AS Error
BY customer
| eval successRate = ((Success/Total)*100)."%" Please let me know if my understanding is correct? also, for success events, the msg.errorCode field will not come in the logs and it will come only for the error event logs. So I want to count an event as Success if the msg.errorCode field is not coming and as Error if its coming. Hopelully, my logic of using "isnull" and "isnotnull" is correct in this case? Please clarify and Thank you so much again for response and clearing my doubts. 🙂
... View more
03-10-2023
12:47 AM
Hello People, I am trying to run below splunk query, base search | rename msg.message as "message", msg.customer as "customer" | eval Total_Count = 1, Total_Success = if(where isnull( msg.errorCode),"1","0"), Total_Error = if(where isnotnull( msg.errorCode),"1","0") | fields Total_Count,Total_Success,Total_Error,message,customer | stats sum(Total_Count) as Total, sum(Total_Success) as Success, sum(Total_Error) as Error | eval successRate = ((Success/Total)*100)."%" | stats Total, Success, successRate by customer and I am getting below error Error in 'eval' command: The expression is malformed. Expected IN. Can anyone please let me know what am I doing wrong here? Thanks !!!
... View more
Labels
- Labels:
-
search head
