How to calculate success rate using SPL in Splunk

Coding - Tutorial
, ,

Today I will introduce three possible ways to calculate success rate using SPL in Splunk.

Calculate success rate of total logs depending on log level

For example, here I will count all the log entries as Total, while entries that have log level “ERROR” as Failures.

source="*/ECommerceApplication/starter_code/logs/*" host="Mac.local" sourcetype="log4j"
 | stats count(eval(match(LogLevel, "ERROR"))) AS f, count as t
 | eval s = t-f, percF = (f/t)*100, percS=100-percF
 | rename t as Total, percF as FailureRate, percS as SuccessRate, f as FailCount, s as SuccessCount
 | table Total, FailCount, FailureRate, SuccessCount, SuccessRate
Total, FailCount, FailureRate, SuccessCount, SuccessRate

Calculate success rate of specific HTTP request

For example, here I will calculate the success rate of requests that create user.

source="*/ECommerceApplication/starter_code/logs/*" host="Mac.local" sourcetype="log4j" Create user
 | stats count(eval(searchmatch("*Create user success*"))) AS s, count as t
 | eval percS = round((s/t)*100,2)
 | rename t as TotalCreateUser, percS as SuccessRate
 | table TotalCreateUser, SuccessRate
TotalCreateUser, SuccessRate

Calculate success rate within a specific time interval

For example, here I will calculate the success rate per day of requests that create user.

source="*/ECommerceApplication/starter_code/logs/*" host="Mac.local" sourcetype="log4j" Create user
 | bucket _time span=day
 | stats count as t,
         count(eval(searchmatch("*success*"))) as s by _time
 | eval percS = round((s/t)*100,2)
 | rename percS as "Success Rate"
 | fields - s,t
Success rate per day





References

How to write a search where if a certain string is found in a log, set Status=1, otherwise Status=0?

How to write a search to calculate percentages for success and failure rates from my user log data?

How to calculate the percentage of failed requests (HTTP status 401) using Splunk query?

Need to get stats count by day

Splunk - Stats search count by day with percentage against day-total