Splunk Search

How to consolidate the percentage of errors per day in a timechart?

PabloBonilha
Explorer

Hello everyone,

I'm trying to consolidate the percentage of errors per day using the query below, but this is not happening

The selected period is the last seven days.

index="index" | timechart count(type) as SENT, count(eval(type="b")) as ERROR | eval PERCENT=((ERROR*100)/SENT) | table PERCENT

Please tell me what can be wrong in this query.

Thank you,

1 Solution

emiller42
Motivator

The only problem I'm seeing here is that in your final | table you're not including the _time field. Otherwise, this should work exactly as you expect it to. I recommend doing | table _time PERCENT to keep the date included in your final results.

If this doesn't help, can you be more specific about what you're seeing, and how it isn't correct?

View solution in original post

emiller42
Motivator

The only problem I'm seeing here is that in your final | table you're not including the _time field. Otherwise, this should work exactly as you expect it to. I recommend doing | table _time PERCENT to keep the date included in your final results.

If this doesn't help, can you be more specific about what you're seeing, and how it isn't correct?

PabloBonilha
Explorer

Hi emiller42,

I appreciate your answer, but it doesn't work some like I need.

Following your suggestion, I have this information:

_time PERCENT
10/21/14 10:33:00.000 AM 1.42
10/21/14 10:34:00.000 AM 0.49
10/21/14 10:35:00.000 AM 0.27

But, I'm looking something like this:

DATE PERCENT
10/21/2014 5.00
10/20/2014 3.50
10/19/2014 2.25

I still did not get the expected result.

0 Karma

emiller42
Motivator

Are you still doing the timechart portion of your search? If so, and your search timeframe is over 7 days, it should automatically bucket by day. You can force the bucketing like so: ...| timechart span=1d ... if needed.

PabloBonilha
Explorer

I would like to thank you for your help. The search it is working well.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...