splunksplunk-querysplunk-calculation

Splunk percentage value for each category


I have 2 columns service and status. How do I calculate percentage availability for each service.

total count for that service -> ts
5xx status for that service  -> er_s

availability = ((ts - er_s) / ts) * 100

I am able to get as a whole or separate result for each service, but I am looking for availability for each app, in one place.


Solution

  • What have you tried so far? Did it include a stats command to compute the totals and an eval to calculate the availability?

    ... | stats count as ts, sum(eval(status>=500 AND status<=599)) as er_s by service
    | eval availability=((ts - er_s) * 100 / ts)