Splunk Search

How to create top command results in timechart?

brajaram
Communicator

I'm trying to make a timechart to show percentage of error rates over a given time period. What I am looking for from a visualization perspective is a line chart that shows for any binned time period, what the total count of a specific error was, and what the overall percentage that was, and to have the chart be drawn based on the percentage.

Ideally, I'd have both counts and percents on the same chart, but percentage is the important one so I can calculate percentage error over a given timeperiod.

So far, my query is as follows:

Initial Search to create the necessary variables|table errorCode _time|bin span=5m _time| eventstats count as total by _time 
| stats count values(total) as total by _time, errorCode

errorCode contains a variety of values, with one value corresponding to success. In theory this should give me a table that looks like

_time               errorCode               count          total
Bucket1          ErrorCode1             X                  X+Y+Z
Bucket1          ErrorCode2             Y                  X+Y+Z
Bucket1          Success                Z                  X+Y+Z 

From there I would be able to use an eval perc=count/total*100 to be able to build the timechart. However, the total column is incorrect and does not result in the correct values. What would be a better way to build this query out, and is it possible to have the chart be drawn based on percent, but have in any given tooltip percent and count values?

0 Karma
1 Solution

mayurr98
Super Champion

Try this

Initial Search to create the necessary variables 
| bin span=5m _time 
| table errorCode _time 
| stats count by _time, errorCode 
| eventstats sum(count) as total by _time 
| eval perc=round((count*100)/total,2)

let me know if this helps!

View solution in original post

mayurr98
Super Champion

Try this

Initial Search to create the necessary variables 
| bin span=5m _time 
| table errorCode _time 
| stats count by _time, errorCode 
| eventstats sum(count) as total by _time 
| eval perc=round((count*100)/total,2)

let me know if this helps!

brajaram
Communicator

Yep, it works.

If I add in a |timechart values(perc) by errorCode it creates a visualization.

Thanks!

0 Karma
Get Updates on the Splunk Community!

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...