https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403353#M116716 <P>@kvanwagoner Try this -</P> <PRE><CODE> "A PUT was made to OpenAAA API - Status: *" | rex "Status: (?&lt;status&gt;\w+)" | spath AppID | search AppID=200296 Environment=prod | timechart count(eval(status="OK")) as success, count(eval(status="1")) as failures| bin span=7d _time | stats avg(success) as S, avg(failures) as F| eval pct=( F * 100 ) / S </CODE></PRE> Tue, 04 Jun 2019 20:31:39 GMT Vijeta 2019-06-04T20:31:39Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403349#M116712 <P>I've got 2 search queries that are working for me (Thanks to @harshpatel)</P> <P><STRONG>Query #1</STRONG> returns the average # of successes over the last 7 Days.</P> <PRE><CODE>"A PUT was made to OpenAAA API - Status: OK" | spath AppID | search AppID=200296 Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod) </CODE></PRE> <P><STRONG>Query #2</STRONG> returns the average # of failures over the last 7 Days.</P> <PRE><CODE>"A PUT was made to OpenAAA API - Status: 1" | spath AppID | search AppID=200296 Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod) </CODE></PRE> <P>How can I find out the percentage of failures based on these 2 queries? AVG # of Failures divided by AVG # of Successes </P> <P>Example. 100 success and 50 failures .... Percentage of Failures would be 50%)</P> <P>Any help will be greatly appreciated!</P> <P>Thanks</P> Tue, 04 Jun 2019 11:26:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403349#M116712 kvanwagoner 2019-06-04T11:26:16Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403350#M116713 <P>Try combining the two queries.</P> <PRE><CODE>"A PUT was made to OpenAAA API - Status: *" | rex "Status: (?&lt;status&gt;\w+)" | spath AppID | search AppID=200296 Environment=prod | timechart count by Environment | bin span=7d _time | stats count, count(eval(status="OK")) as successes, count(eval(status=1)) as failures | eval pct=(failures*100)/successes </CODE></PRE> Tue, 04 Jun 2019 13:42:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403350#M116713 richgalloway 2019-06-04T13:42:34Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403351#M116714 <P>Thanks @richgalloway <BR /> This is returning <BR /> count=08<BR /> failures=0<BR /><BR /> successes=0<BR /> The two separate queries return 359 success and 7 failures. Which would be around 1.9%</P> <P>Any ideas?</P> Tue, 04 Jun 2019 15:13:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403351#M116714 kvanwagoner 2019-06-04T15:13:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403352#M116715 <P>@harshpatel any ideas on this?</P> Tue, 04 Jun 2019 18:07:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403352#M116715 kvanwagoner 2019-06-04T18:07:37Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403353#M116716 <P>@kvanwagoner Try this -</P> <PRE><CODE> "A PUT was made to OpenAAA API - Status: *" | rex "Status: (?&lt;status&gt;\w+)" | spath AppID | search AppID=200296 Environment=prod | timechart count(eval(status="OK")) as success, count(eval(status="1")) as failures| bin span=7d _time | stats avg(success) as S, avg(failures) as F| eval pct=( F * 100 ) / S </CODE></PRE> Tue, 04 Jun 2019 20:31:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403353#M116716 Vijeta 2019-06-04T20:31:39Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403354#M116717 <P>Thanks @Vijeta . That works great! </P> Wed, 05 Jun 2019 12:47:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-percentage-out-of-2-queries/m-p/403354#M116717 kvanwagoner 2019-06-05T12:47:49Z