Splunk Search

How to combine 2 search results and calculate error rate?

haleefe
New Member

I am trying to determine the error rate.

Total Count per URI:

index=applogsprd java_class="*content.common.spring.LoggingInterceptor*” uri="*/api/v*"   | fields uri | stats Count as count,  by uri

Error Count per URI:

index=applogsprd java_class="*content.ws.rest.v1.error.ErrorHandler*" uri="*/api/v*" | fields uri | stats Count as errorCount,  by uri

The result I'm looking for is a table:
uri , totalCount, errorCount, error rate (errorCount/totalCount)

I've tried appendcols, but can't seem to make that work.

0 Karma

sundareshr
Legend

Try this

index=applogsprd uri="/api/v"  | stats count(eval(java_class="content.common.spring.LoggingInterceptor”)) as count count(eval(java_class="content.ws.rest.v1.error.ErrorHandler")) as error  | eval errorRate=error/count
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...