https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644260#M223162 <P>failed/Total events&nbsp;</P> Tue, 23 May 2023 13:52:40 GMT AnaSpiStats 2023-05-23T13:52:40Z https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644254#M223159 <P>This is my search:</P><PRE>message_data_type=gd*| timechart count by message_data_type limit=10</PRE><P>These are my results:</P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="AnaSpiStats_0-1684848039033.png" style="width: 648px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/25512iB5EE608FDDC78FC9/image-dimensions/648x94?v=v2" width="648" height="94" role="button" title="AnaSpiStats_0-1684848039033.png" alt="AnaSpiStats_0-1684848039033.png" /></span></P><P>But I need to create a timechart of the&nbsp; failed/total events ratio.</P><P>How can I do that ?</P> Tue, 23 May 2023 13:54:27 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644254#M223159 AnaSpiStats 2023-05-23T13:54:27Z https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644258#M223161 <P>Is that what you really want to do? What if there are zero failed events - Success/zero is infinity, or Failed/zero is infinity if there are zero Success events?</P> Tue, 23 May 2023 13:41:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644258#M223161 ITWhisperer 2023-05-23T13:41:24Z https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644260#M223162 <P>failed/Total events&nbsp;</P> Tue, 23 May 2023 13:52:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644260#M223162 AnaSpiStats 2023-05-23T13:52:40Z https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644263#M223163 <LI-CODE lang="markup">| timechart count by message_data_type | addtotals col=f row=t | eval failedratio=failed/Total | fields _time failedratio Total</LI-CODE> Tue, 23 May 2023 14:27:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-make-timechart-with-ratio-failed-total/m-p/644263#M223163 ITWhisperer 2023-05-23T14:27:22Z