Splunk Search

Calculate ratio for 500's status error

blago
Engager

I would like to get % for 5xx's errors.
How to calculate that?
alt text

Tags (1)
0 Karma

niketn
Legend

@blago, please try the following:

<YourBaseSearch>
| addtotals row=t fieldname="Row_Total"
| eval Perc_5xx=round(('5xx'/Row_Total)*100,2)
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
Get Updates on the Splunk Community!

More Ways To Control Your Costs With Archived Metrics | Register for Tech Talk

Tuesday, May 14, 2024  |  11AM PT / 2PM ET Register to Attend Join us for this Tech Talk and learn how to ...

.conf24 | Personalize your .conf experience with Learning Paths!

Personalize your .conf24 Experience Learning paths allow you to level up your skill sets and dive deeper ...

Threat Hunting Unlocked: How to Uplevel Your Threat Hunting With the PEAK Framework ...

WATCH NOWAs AI starts tackling low level alerts, it's more critical than ever to uplevel your threat hunting ...