Splunk Search

How to create a timeseries that is derived by dividing similar columns from two other timeseries

Splunkster45
Communicator

Once search query allows me to get the total percentage of failed calls in a 24 hour window

index= ...  | stats count(client_ip) as Calls | appendcols [ search index=...  | stats count(IPAddress) AS Fails] |  eval "Percent Fails"=Fails/Calls*100 

If I put the base searches of each the above two searches into the variables A and B, I get

    A  | stats count(client_ip) as Calls | appendcols [ B | stats count(IPAddress) AS Fails] |  eval "Percent Fails"=Fails/Calls*100 

I can also create a timeseries for the number of calls and the number of fails by the following

A | timechart count span=1h
B | timechart count span=1h 

Is there a way that I can combine the two? I want to be able to get a timeseries of the percentage of failed calls per hour over the last 24 hours.

Essentially, this would equate to taking each hour in B and dividing it by the same hour in A. Does anyone have any idea of how to do this?

Thanks!

Tags (2)
0 Karma

btt
Path Finder

Hi,

index= .... | bucket span=1h _time 
| stats count(client_ip) as Calls  count(IPAddress) AS Fails
|timechart per_hour(eval(Fails/Calls*100)) as  Percent_Fails
0 Karma
Get Updates on the Splunk Community!

Prove Your Splunk Prowess at .conf25—No Prereqs Required!

Your Next Big Security Credential: No Prerequisites Needed We know you’ve got the skills, and now, earning the ...

Splunk Observability Cloud's AI Assistant in Action Series: Observability as Code

This is the sixth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...

Splunk Answers Content Calendar, July Edition I

Hello Community! Welcome to another month of Community Content Calendar series! For the month of July, we will ...