https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674704#M230955 <P>By the look of your screenshot shared, it appears that as a result of the&nbsp;</P><LI-CODE lang="markup">| stats values(NumberOfAuthErrors) AS NumberOfAuthErrors, values(TotalRequest) AS TotalRequest</LI-CODE><P>is returning you two multivalued fields, so the eval is not working as intended.<BR />Try putting this stats with an additional by-field of _time again, that way each NumberOfAuthErrors and TotalRequest values should only have 1 value for each 15 minute interval and then the eval will probably work.<BR /><BR />If for whatever reason you are trying to sum up each row of two multivalued fields (Don't really know why you would want to do this), I would stay away from using stats values() as this is going to dedup values and then I believe sort them. using stats list() instead will retain the original order, but even then, if one of the datasets is missing events in one or more of the 15 minute intervals, then number will again be misaligned.<BR /><BR />You would be better off just using a stats by-field of _time again, something like this.</P><LI-CODE lang="markup">[SEARCH] | bin _time span=15m | stats count as NumberOfAuthErrors by _time | append [ SEARCH | bin _time span=15m | stats count as TotalRequest by _time ] | stats values(NumberOfAuthErrors) AS NumberOfAuthErrors, values(TotalRequest) AS TotalRequest by _time | eval failureRate = round((NumberOfAuthErrors / TotalRequest) * 100,3) | table _time, TotalRequest NumberOfAuthErrors failureRate</LI-CODE><P><BR />If you just want the overall failureReate through the entire timespan the using a stats sum() will probably be the way to go.<BR /><BR /></P><LI-CODE lang="markup">[SEARCH] | bin _time span=15m | stats count as NumberOfAuthErrors by _time | append [ SEARCH | bin _time span=15m | stats count as TotalRequest by _time ] | stats sum(NumberOfAuthErrors) AS NumberOfAuthErrors, sum(TotalRequest) AS TotalRequest | eval failureRate = round((NumberOfAuthErrors / TotalRequest) * 100,3) | table TotalRequest NumberOfAuthErrors failureRate</LI-CODE><P>&nbsp;</P> Thu, 18 Jan 2024 17:06:37 GMT dtburrows3 2024-01-18T17:06:37Z https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674699#M230952 <P>Hi All,</P><P>I'm trying to calculate the failureRate as a percentage between the NumberOfAuthErrors column and the TotalRequest column, but i do not get any values.</P><P>I do have two columns of values. I would like to calculate the failureRate for each ROW.</P><P>&nbsp;</P><LI-CODE lang="markup">[SEARCH] | bin _time span=15m | stats count as NumberOfAuthErrors by _time | append [ SEARCH | bin _time span=15m | stats count as TotalRequest by _time ] | stats values(NumberOfAuthErrors) AS NumberOfAuthErrors, values(TotalRequest) AS TotalRequest | eval failureRate = round((NumberOfAuthErrors / TotalRequest) * 100,3) | table TotalRequest NumberOfAuthErrors failureRate</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>thanks</P> Thu, 18 Jan 2024 16:57:00 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674699#M230952 becksyboy 2024-01-18T16:57:00Z https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674703#M230954 <P>Try including by _time on this line</P><LI-CODE lang="markup">| stats values(NumberOfAuthErrors) AS NumberOfAuthErrors, values(TotalRequest) AS TotalRequest by _time</LI-CODE> Thu, 18 Jan 2024 17:06:10 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674703#M230954 ITWhisperer 2024-01-18T17:06:10Z https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674704#M230955 <P>By the look of your screenshot shared, it appears that as a result of the&nbsp;</P><LI-CODE lang="markup">| stats values(NumberOfAuthErrors) AS NumberOfAuthErrors, values(TotalRequest) AS TotalRequest</LI-CODE><P>is returning you two multivalued fields, so the eval is not working as intended.<BR />Try putting this stats with an additional by-field of _time again, that way each NumberOfAuthErrors and TotalRequest values should only have 1 value for each 15 minute interval and then the eval will probably work.<BR /><BR />If for whatever reason you are trying to sum up each row of two multivalued fields (Don't really know why you would want to do this), I would stay away from using stats values() as this is going to dedup values and then I believe sort them. using stats list() instead will retain the original order, but even then, if one of the datasets is missing events in one or more of the 15 minute intervals, then number will again be misaligned.<BR /><BR />You would be better off just using a stats by-field of _time again, something like this.</P><LI-CODE lang="markup">[SEARCH] | bin _time span=15m | stats count as NumberOfAuthErrors by _time | append [ SEARCH | bin _time span=15m | stats count as TotalRequest by _time ] | stats values(NumberOfAuthErrors) AS NumberOfAuthErrors, values(TotalRequest) AS TotalRequest by _time | eval failureRate = round((NumberOfAuthErrors / TotalRequest) * 100,3) | table _time, TotalRequest NumberOfAuthErrors failureRate</LI-CODE><P><BR />If you just want the overall failureReate through the entire timespan the using a stats sum() will probably be the way to go.<BR /><BR /></P><LI-CODE lang="markup">[SEARCH] | bin _time span=15m | stats count as NumberOfAuthErrors by _time | append [ SEARCH | bin _time span=15m | stats count as TotalRequest by _time ] | stats sum(NumberOfAuthErrors) AS NumberOfAuthErrors, sum(TotalRequest) AS TotalRequest | eval failureRate = round((NumberOfAuthErrors / TotalRequest) * 100,3) | table TotalRequest NumberOfAuthErrors failureRate</LI-CODE><P>&nbsp;</P> Thu, 18 Jan 2024 17:06:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674704#M230955 dtburrows3 2024-01-18T17:06:37Z https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674716#M230960 <P>Thank You for the help, the missing by clause worked (by _time)</P> Thu, 18 Jan 2024 17:48:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674716#M230960 becksyboy 2024-01-18T17:48:19Z https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674717#M230961 <P>Thank you also for the same solution and the additional context, this is really helpful.</P> Thu, 18 Jan 2024 17:49:17 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calcualte-an-Eval-of-percentage-between-two-rows-of-stats/m-p/674717#M230961 becksyboy 2024-01-18T17:49:17Z