Generate percentage and filter based on it from events with count in them (so I cannot use "top")?

[arun_kant_sharm]

Hi Experts,
I need to create a alert , if HTTPCode_Target_5XX_Count is greater than 5% of Total count then i need to send alert mail.
My SPL

sourcetype=aws:cloudwatch
| spath path=Average
| spath path=Maximum
| spath path=Minimum 
| spath path=SampleCount 
| spath path=Sum 
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions 
| spath path=metric_name
| spath path=period
| spath path=timestampe 
| search metric_dimensions="*app/adj-tok-nonprod-web-in-alb/*" AND metric_name=HTTPCode_Target*  | stats sum(SampleCount)  by metric_name |rename sum(SampleCount)  as SampleCount |  addtotals row=f col=t labelfield=metric_name  SampleCount 

Output Format:

metric_name              SampleCount
HTTPCode_Target_2XX_Count       14684
HTTPCode_Target_3XX_Count        9551
HTTPCode_Target_4XX_Count         189
HTTPCode_Target_5XX_Count          44
Total                           24468

Suggest what i need to append in my SPL to get proper result

[woodcock · Accepted solution]

Like this:

index="YouShouldAlwaySpecifyAnIndex" AND sourcetype="aws:cloudwatch"
| spath path=Average
| spath path=Maximum
| spath path=Minimum 
| spath path=SampleCount 
| spath path=Sum 
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions 
| spath path=metric_name
| spath path=period
| spath path=timestampe 
| search metric_dimensions="*app/adj-tok-nonprod-web-in-alb/*" AND metric_name=HTTPCode_Target* 
| stats sum(SampleCount) AS SampleCount BY metric_name
| eventstats sum(SampleCount) AS GrandTotal
| eval pct = 100 * (SampleCount / GrandTotal)
| where pct > 5

[woodcock]

P.S. Your subject stinks. Try harder next time.

[woodcock]

I fixed it for you.

[renjith_nair]

@arun_kant_sharma ,

Try

sourcetype=aws:cloudwatch | spath path=Average
| spath path=Maximum
| spath path=Minimum
| spath path=SampleCount
| spath path=Sum
| spath path=Unit
| spath path=account_id
| spath path=metric_dimensions
| spath path=metric_name
| spath path=period
| spath path=timestampe
| search metric_dimensions="app/adj-tok-nonprod-web-in-alb/" AND metric_name=HTTPCode_Target* 
| stats sum(SampleCount) as total,sum(eval(if(metric_name=="HTTPCode_Target_5XX_Count",SampleCount,0))) as 5xx
| eval perc=round((5xx/total)*100,2)
| where perc > 5