https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455478#M172291 <P>Thanks adonio.<BR /> I was missing in a point to use eventstats for the same.<BR /> I have achieved the desired results.</P> Mon, 25 Mar 2019 11:26:44 GMT sahil237888 2019-03-25T11:26:44Z https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455476#M172289 <P>Hi, I need help in creating one query.<BR /> There is one field "Operator" having multiple values like airphone,bphone,vsphone etc.</P> <P>The query should return the total count of each (airphone,bphone,vsphone etc.) per minute along with failed percentage of each.</P> <P>Also if that query could specify for which location there are maximum failure of each.</P> Sun, 24 Mar 2019 17:26:33 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455476#M172289 sahil237888 2019-03-24T17:26:33Z https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455477#M172290 <P>hello there, <BR /> with plenty of respect, it seems like you are almost asking us to do your homework for you.<BR /> how would you tell if its failed or succeeded?<BR /> what have you tried so far? share your search please as well as a sample data.</P> Sun, 24 Mar 2019 22:01:07 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455477#M172290 adonio 2019-03-24T22:01:07Z https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455478#M172291 <P>Thanks adonio.<BR /> I was missing in a point to use eventstats for the same.<BR /> I have achieved the desired results.</P> Mon, 25 Mar 2019 11:26:44 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455478#M172291 sahil237888 2019-03-25T11:26:44Z https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455479#M172292 <P>Glad you're able to find a resolution on your own. Please post the search/solution that has worked for you as an answer and accept the same to close this question. This will help other splunkers with similar issues to know the working solution.</P> Mon, 25 Mar 2019 13:37:28 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455479#M172292 somesoni2 2019-03-25T13:37:28Z https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455480#M172293 <P>Working search:</P> <PRE><CODE>source="logfilename" host="test" index="splunkdata" earliest=-10m | eventstats count(eval(Logon_message="for")) as Successful by Operator | eventstats count(eval(Logon_message="error")) as Failed by Operator | eventstats count(eval(Logon_message="*")) as Total by Operator | eval perc_error = ((Failed)/(Total)*100) | stats values(Successful) as "Total Successful" values(Failed) as "Total Failed" values(Total) as "Total Logins" values(perc_error) as Percentage by Operator </CODE></PRE> Tue, 26 Mar 2019 03:32:52 GMT https://community.splunk.com/t5/Splunk-Search/Splunk-search-for-failed-count-percentage-out-of-total-of-each/m-p/455480#M172293 sahil237888 2019-03-26T03:32:52Z