Splunk Search

How to create a timeseries that is derived by dividing similar columns from two other timeseries

Splunkster45
Communicator

Once search query allows me to get the total percentage of failed calls in a 24 hour window

index= ...  | stats count(client_ip) as Calls | appendcols [ search index=...  | stats count(IPAddress) AS Fails] |  eval "Percent Fails"=Fails/Calls*100 

If I put the base searches of each the above two searches into the variables A and B, I get

    A  | stats count(client_ip) as Calls | appendcols [ B | stats count(IPAddress) AS Fails] |  eval "Percent Fails"=Fails/Calls*100 

I can also create a timeseries for the number of calls and the number of fails by the following

A | timechart count span=1h
B | timechart count span=1h 

Is there a way that I can combine the two? I want to be able to get a timeseries of the percentage of failed calls per hour over the last 24 hours.

Essentially, this would equate to taking each hour in B and dividing it by the same hour in A. Does anyone have any idea of how to do this?

Thanks!

Tags (2)
0 Karma

btt
Path Finder

Hi,

index= .... | bucket span=1h _time 
| stats count(client_ip) as Calls  count(IPAddress) AS Fails
|timechart per_hour(eval(Fails/Calls*100)) as  Percent_Fails
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Data Persistence in the OpenTelemetry Collector

This blog post is part of an ongoing series on OpenTelemetry. What happens if the OpenTelemetry collector ...

Introducing Splunk 10.0: Smarter, Faster, and More Powerful Than Ever

Now On Demand Whether you're managing complex deployments or looking to future-proof your data ...

Community Content Calendar, September edition

Welcome to another insightful post from our Community Content Calendar! We're thrilled to continue bringing ...