how to set baseline in Splunk with certailn requirement

I am very new to a server monitoring tool i.e Splunk!. I hav a requirement to set baseline in splunk i.e how many http requests are failing. If it goes more than 2% then it shud show Failed else it should show Passed in report.

How can i set this baseline.....totally going out of head as am not into this server/netwrking background.

Any links or articles related to it....?

Please let me know if i am not cle开发者_运维知识库ar with the details i posted. am in hurry and need guidance...

Thanks Sundar

---

Are the http request failings getting logged to syslog? If so, you should be able to see what HTTP status codes relate to the failures in general and run your report based on that