Splunk Search

Alerting on a percentage of events

tmenagh
Explorer

I want to craft an alert that will get the number of errors:

sourcetype="my-thing" error | stats count

and the number of not errors:

sourcetype="my-thing" NOT error | stats count

then get the percentage of the first over the second

Tags (1)
0 Karma
1 Solution

tmenagh
Explorer

I think I got it:

sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100

View solution in original post

tmenagh
Explorer

I think I got it:

sourcetype="my-thing" | eval err = if(searchmatch("error"), 1, 0) | eval notErr = if(searchmatch("NOT error"), 1, 0) | stats sum(err) as errNo sum(notErr) as notErrNo | eval errorPercentage = errNo/notErrNo*100

tmenagh
Explorer

Good call, Reed!

0 Karma

reed_kelly
Contributor

Looking good. I would have thought you want errNo/count*100. If you have only errors, you will get divide by zero error instead of 100%.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...