Splunk Search

How could I chart ratio of counts of field values?

jchowdown
New Member

Hi, suppose my events contain this field with two possible values:

Ok=True or
Ok=False

Every hour, I'll have a certain number ('TTT') of True values and a certain number ('FFF') of False values.

I want to create a chart that shows the failure rate (FFF/(TTT+FFF)) for any given time bucket size.

Is that possible please?

Thanks in advance.

0 Karma
1 Solution

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| bin _time span=1h
| chart count BY _time Ok
| eval pct=100*False/(False+True)
| timechart span=1h first(pct) AS pct

View solution in original post

0 Karma

woodcock
Esteemed Legend

Like this:

index=YouShouldAlwaysSpecifyAnIndex AND sourcetype=AndSourcetypeToo
| bin _time span=1h
| chart count BY _time Ok
| eval pct=100*False/(False+True)
| timechart span=1h first(pct) AS pct
0 Karma

woodcock
Esteemed Legend

I had a mistake and edited my answer to fix it. Try again.

0 Karma

jchowdown
New Member

This is perfect, thanks! Works like a charm!

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

Yep. Do this |eval rate = (FFF/(TTT+FFF)) | timechart span=1h avg(rate) as rate

You can set span to whatever you want.

0 Karma

jchowdown
New Member

Sorry, I'm still a noob when it comes to splunk, but how would I actually obtain the queries for FFF and TTT?
I tried various combinations of this (and the answer below) but nothing gets charted

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...