Splunk Search

How to create a timeseries that is derived by dividing similar columns from two other timeseries

Splunkster45
Communicator

Once search query allows me to get the total percentage of failed calls in a 24 hour window

index= ...  | stats count(client_ip) as Calls | appendcols [ search index=...  | stats count(IPAddress) AS Fails] |  eval "Percent Fails"=Fails/Calls*100 

If I put the base searches of each the above two searches into the variables A and B, I get

    A  | stats count(client_ip) as Calls | appendcols [ B | stats count(IPAddress) AS Fails] |  eval "Percent Fails"=Fails/Calls*100 

I can also create a timeseries for the number of calls and the number of fails by the following

A | timechart count span=1h
B | timechart count span=1h 

Is there a way that I can combine the two? I want to be able to get a timeseries of the percentage of failed calls per hour over the last 24 hours.

Essentially, this would equate to taking each hour in B and dividing it by the same hour in A. Does anyone have any idea of how to do this?

Thanks!

Tags (2)
0 Karma

btt
Path Finder

Hi,

index= .... | bucket span=1h _time 
| stats count(client_ip) as Calls  count(IPAddress) AS Fails
|timechart per_hour(eval(Fails/Calls*100)) as  Percent_Fails
0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...