Splunk Search

how to calculate the Success events percentage based on the time intervals.

mvaradarajam
Path Finder

Hi All,

how to calculate percentage value based on time intervals.here i am writting a query

index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="Success"
| timechart span=1d count(DashboardStatus) as Success by sourcetype
| appendcols
[ search index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="*"
| bucket _time span=1d
|stats count(eval(eventtype="YViewStatus" OR eventtype="SViewStatus")) as ClientSuccess count(DashboardStatus) as complete by _time
| eval percent=(ClientSuccess*100/complete)
|table percent
]

Here "YViewStatus" is the event type,it display the success records.
"DashboardStatus" is the field type (Success/Failed).we are calculating the percentage based on the Success/Total events.
using the above query there is a mismatch b/w time intervals,can u plz suggest the right query.
thanks for advance.

Tags (2)
0 Karma

yannK
Splunk Employee
Splunk Employee

The appendcols do not insure that the exact same time range from the 2 searches will match.
you should use a bucket _time span and join them on the field _time.

Instead of |appendcols [, use | join _time [

Also you are using 2 searches (one for success, one for all dashboard and stats), you could try to use only one
please try with something like :

index=operartions sourcetype="SView" OR sourcetype="YView" DashboardStatus="*"
| bucket _time span=1d |
| stats count(eval(DashboardStatus="Success")) AS Success count(eval(eventtype="YViewStatus" OR eventtype="SViewStatus")) AS ClientSuccess count(DashboardStatus) AS complete by _time sourcetype
| eval percent=(ClientSuccess*100/complete)

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...