Splunk Search

How to combine 2 search results and calculate error rate?

haleefe
New Member

I am trying to determine the error rate.

Total Count per URI:

index=applogsprd java_class="*content.common.spring.LoggingInterceptor*” uri="*/api/v*"   | fields uri | stats Count as count,  by uri

Error Count per URI:

index=applogsprd java_class="*content.ws.rest.v1.error.ErrorHandler*" uri="*/api/v*" | fields uri | stats Count as errorCount,  by uri

The result I'm looking for is a table:
uri , totalCount, errorCount, error rate (errorCount/totalCount)

I've tried appendcols, but can't seem to make that work.

0 Karma

sundareshr
Legend

Try this

index=applogsprd uri="/api/v"  | stats count(eval(java_class="content.common.spring.LoggingInterceptor”)) as count count(eval(java_class="content.ws.rest.v1.error.ErrorHandler")) as error  | eval errorRate=error/count
0 Karma
Get Updates on the Splunk Community!

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...