Splunk Search

Calculate Percentage of status code for 200 by _time

Chirag812
Explorer

I want to calculate the Percentage of status code for 200 out of Total counts of Status code by time. I have written query as per below by using append cols. Below query is working but it is not giving percentage every minute or by _time wise. I want this Percentage of status code for 200 by _time also. So can anybody help me out on this how to write this query.

index=* sourcetype=* host=*
| stats count(sc_status) as Totalcount
| appendcols
[ search index=* sourcetype=* host=* sc_status=200
| stats count(sc_status) as Count200 ]
| eval Percent200=Round((Count200/Totalcount)*100,2)
| fields _time Count200 Totalcount Percent200

Labels (3)
0 Karma

Chirag812
Explorer

Thanks a lot. This worked perfectly.

0 Karma

dtburrows3
Builder

Since you are just wanting to display percentage of 200 and total count of all StatusCode in each minute.
I think a search like this should work.

 

index=<index> sourcetype=<sourcetype> sc_status=*
    | bucket span=1m _time
    | stats
        count as Totalcount,
        count(eval('sc_status'==200)) as Count200
            by _time
    | eval
        Percent200=round(('Count200'/'Totalcount')*100, 2)
    | fields + _time, Percent200, Totalcount

 

Example Output:

dtburrows3_0-1705010117147.png

 

0 Karma
Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

  Ready to master Kubernetes and cloud monitoring like the pros?Join Splunk’s Growth Engineering team for an ...

Wrapping Up Cybersecurity Awareness Month

October might be wrapping up, but for Splunk Education, cybersecurity awareness never goes out of season. ...

🌟 From Audit Chaos to Clarity: Welcoming Audit Trail v2

&#x1f5e3; You Spoke, We Listened  Audit Trail v2 wasn’t written in isolation—it was shaped by your voices.  In ...