Say I am parsing a file which contains response codes as "response_code" and response times as "response_time".
I then want to visualise this in a table with:
| count avg(response_time) as Average, count as ResponseCount by response_code
I would also like to know what percentage of all transactions in the selected timeframe each count of "response_code" accounts for and add that as a field showing that percentage.
I don't know what the response_code values could be for the query as they are dynamic.
Imagine I have data like:
I would want the output to look like:
response_code Average ResponseCount PercentageOfTransactions
1 200 3 75
2 150 1 25
In splunk I would do this with eventstats to calculate the total and the percentage then report the percentage as values(PercentageOfTransactions)
Please sign in to leave a comment.