Splunk Search

Calculate Percentage of status code for 200 by _time

Chirag812
Explorer

I want to calculate the Percentage of status code for 200 out of Total counts of Status code by time. I have written query as per below by using append cols. Below query is working but it is not giving percentage every minute or by _time wise. I want this Percentage of status code for 200 by _time also. So can anybody help me out on this how to write this query.

index=* sourcetype=* host=*
| stats count(sc_status) as Totalcount
| appendcols
[ search index=* sourcetype=* host=* sc_status=200
| stats count(sc_status) as Count200 ]
| eval Percent200=Round((Count200/Totalcount)*100,2)
| fields _time Count200 Totalcount Percent200

Labels (3)
0 Karma

Chirag812
Explorer

Thanks a lot. This worked perfectly.

0 Karma

dtburrows3
Builder

Since you are just wanting to display percentage of 200 and total count of all StatusCode in each minute.
I think a search like this should work.

 

index=<index> sourcetype=<sourcetype> sc_status=*
    | bucket span=1m _time
    | stats
        count as Totalcount,
        count(eval('sc_status'==200)) as Count200
            by _time
    | eval
        Percent200=round(('Count200'/'Totalcount')*100, 2)
    | fields + _time, Percent200, Totalcount

 

Example Output:

dtburrows3_0-1705010117147.png

 

0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...