https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26269#M177643 <PRE><CODE>... | where failedpct&gt;5 </CODE></PRE> Wed, 07 Nov 2012 12:45:49 GMT Ayn 2012-11-07T12:45:49Z https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26268#M177642 <P>Hi all</P> <P>This might be very straight forward, but i cant get my head around it, so i hope someone is able to help me out.</P> <P>The task is to show every hostname with a value greater than 5 on failedpct.</P> <P>This is my search:</P> <PRE><CODE>sourcetype=stats | stats first(customername) as customer, last(monPingGWCheck) AS upstatus, count, count(FailedModulesString) AS failedcount by hostname | eval failedpct=failedcount/count*100 | eval failedpct=if(upstatus == 1, failedpct, 0) | sort customer, -failedpct | table customer, hostname, upstatus, count, failedcount, failedpct </CODE></PRE> <P>Any suggestion?</P> Wed, 07 Nov 2012 12:25:03 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26268#M177642 polymorphic 2012-11-07T12:25:03Z https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26269#M177643 <PRE><CODE>... | where failedpct&gt;5 </CODE></PRE> Wed, 07 Nov 2012 12:45:49 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26269#M177643 Ayn 2012-11-07T12:45:49Z https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26270#M177644 <P>As i said, VERY straight forward. <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span><BR /> Thank you very much.</P> Wed, 07 Nov 2012 12:47:34 GMT https://community.splunk.com/t5/Splunk-Search/Exclude-search-result/m-p/26270#M177644 polymorphic 2012-11-07T12:47:34Z