Splunk Search

How can I graph percent fails by host over time?

skiller1234
Explorer

OK - I can't get this simple chart to work. Just need to graph Percent Fails by host over time

this is my start right now

index=app sourcetype=app_source source=*source.log "failedfor" OR "worked"
| bucket span=30m _time
| eval bad=if(searchmatch("failedfor"),1,0)
| stats count as total sum(bad) as bad by host
| eval conversion=(bad/total)*100

I can get like variations of the correct stats, but not charted by time and host (% over 30m plot points)..

thank you!
shawn

0 Karma

DalJeanis
Legend

You almost had it. In order to chart across time ( timechart ), you need the _time field.

Your stats command does not include the _time field, so the field stopped existing after that command.

Change to ...

  | stats count as total sum(bad) as bad by host _time
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...

Secure Your Future: Mastering Upgrade Readiness for Splunk 10

Spotlight: The Splunk Health Assistant Add-On  The Splunk Health Assistant Add-On is your ultimate companion ...

Observability Unlocked: Kubernetes & Cloud Monitoring with Splunk IM

Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team on ...