splunksplunk-querysplunk-formula

How to display table of top 5 URL with their status and percentage on splunk


Need a table to show the top 5 URL as given below in Splunk. Is this possible in Splunk? I tried many ways but I can't get all status of a URL as a single row.

API                         200        204  400 401 499 500

/wodetails/ACP              895(50%)    -    -   -   -   1

Solution

  • This is a case where the chart command can be used:

    index="main"  source="access.log" sourcetype="access_combined"
    | chart c(status) by uri, status
    
    uri 200 204 400 499
    /basic/status 11 1 1 1
    /search/results 3 0 0 0

    To add the percentages, you can use eventstats

    index="main"  source="access.log" sourcetype="access_combined"
    
    | eventstats count as "totalCount" by uri
    | eventstats count as "codecount" by uri, status
    | eval percent=round((codecount/totalCount)*100)
    
    | eval cell=codecount." (".percent."%)"
    
    | chart values(cell) by uri,status
    
    uri 200 204 400 499
    /basic/status 11 (79%) 1 (7%) 1 (7%) 1 (7%)
    /search/results 3 (100%)