Splunk Search

Can you help me with my statistics table?

newbie2tech
Communicator

Hi Team,

I need help with the below use case.

I have application logs in which each event has below fields

saleproductname HTTPStatus ResponseTime

Possible HTTPStatus values = 200 , 300 ,400 ,500

I need to do a visualization of a statistics table which shows the below details:

productname TotalCalls AvgResp HTTP2XXcalls HTTP2XXcalls(%) HTTP3XX HTTP3XXs(%) HTTP4XX HTTP4XX(%) HTTP5XX HTTP5XX(%)
AirJordan 100 25.5 50 50 10 10 10 10 30 30

swiftrun 1000 55.5 500 50 100 10 100 10 300 30

I have tried various options using stats and chart but I couldn't quite get it as above.

Appreciate your help, thank you!

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@newbie2tech ,

Try and verify if the number matches .

"your search" |fields saleproductname, HTTPStatus, ResponseTime
| stats count as total_by_prod_status ,sum(ResponseTime) as total_resp by saleproductname,HTTPStatus|sort productId
| eventstats sum(total_by_prod_status) as total_prod by saleproductname|eval perc=round((total_by_prod_status/total_prod)*100,2)
| chart max(total_by_prod_status) as total_by_prod_status, 
        max(total_resp) as total_resp,max(perc) as perc over saleproductname by HTTPStatus
| addtotals total_by_prod_status* fieldname=TotalCalls
| addtotals total_resp* fieldname=AvgResp|eval AvgResp=round(AvgResp/TotalCalls,2)
| rename "total_by_prod_status: *" as HTTP*Calls,"perc: *" as HTTP*Calls(%)|fields - total_resp*
| fields saleproductname,TotalCalls,AvgResp,HTTP*

OR

"your search"|fields saleproductname, HTTPStatus, ResponseTime
|stats count as total_by_prod_status ,sum(ResponseTime) as total_resp  by saleproductname,HTTPStatus
|chart sum(total_by_prod_status) as tot_by_prod,max(total_resp) as tot_resp_by_prod over saleproductname by HTTPStatus
|addtotals tot_by_prod* fieldname=TotalCalls|addtotals tot_resp_by_prod* fieldname=AvgResp|fields - tot_resp_by_prod*
|rename "tot_by_prod: *" as HTTP*Calls
|foreach HTTP*Calls [eval <<FIELD>>(%)=round((<<FIELD>>/TotalCalls)*100,2)]
|eval AvgResp=round(AvgResp/TotalCalls,2)|table saleproductname,TotalCalls,AvgResp,HTTP*

First one might be faster

Happy Splunking!
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...