https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692783#M235785 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/269797">@Idodox</a>&nbsp;,</P><P>please see this approach:</P><LI-CODE lang="markup">&lt;unrelated part to collect proper events&gt; error=4 | eventstats count as total by applicationId | search error=404 | stats count as error_404 values(total) AS total by applicationId | eval errorRate=((error_404/total)*100)."%" | table applicationId, errorRate</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 09 Jul 2024 16:14:21 GMT gcusello 2024-07-09T16:14:21Z https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692779#M235784 <P>I'm trying to get a percentage of a field, based on a condition (filtered by search) by another field.</P><P>e.g.&nbsp; percentage of 404 errors by application. So need to get the total number of requests for each application, filter to keep only 404 errors then count by application. At least that's the logic I used.</P><P>&nbsp;</P><LI-CODE lang="markup">&lt;unrelated part to collect proper events&gt; | eventstats count as total by applicationId | search error=404 | stats count as error_404 by applicationId | eval errorRate=((error_404/total)*100)."%" | table applicationId, errorRate</LI-CODE><P>&nbsp;</P><P>&nbsp;</P><P>This returns a list of applications, but no values for errorRate.<BR />Individually, I'm able to get a result for this:</P><P>&nbsp;</P><LI-CODE lang="markup">| stats count as total by applicationId</LI-CODE><P>&nbsp;</P><P><BR /><BR />And also for this:</P><P>&nbsp;</P><LI-CODE lang="markup">| search error=404 | stats count as error_404 by applicationId</LI-CODE><P>&nbsp;</P><P><BR />But something in having them together in the flow I have doesn't work.<BR /><BR />I also tried this which didn't work. In this instance I get values for applicationId and total. So I guess there's something wrong with how I'm getting the error_404 values.</P><P>&nbsp;</P><LI-CODE lang="markup">| stats count as total by applicationId | appendcols[search error=404|stats count as error_404 by applicationId] | eval errorRate=((error_404/total)*100)."%" | table applicationId, error_404, total, errorRate</LI-CODE><P>&nbsp;</P> Tue, 09 Jul 2024 16:06:01 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692779#M235784 Idodox 2024-07-09T16:06:01Z https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692783#M235785 <P>Hi&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/269797">@Idodox</a>&nbsp;,</P><P>please see this approach:</P><LI-CODE lang="markup">&lt;unrelated part to collect proper events&gt; error=4 | eventstats count as total by applicationId | search error=404 | stats count as error_404 values(total) AS total by applicationId | eval errorRate=((error_404/total)*100)."%" | table applicationId, errorRate</LI-CODE><P>Ciao.</P><P>Giuseppe</P> Tue, 09 Jul 2024 16:14:21 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692783#M235785 gcusello 2024-07-09T16:14:21Z https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692828#M235806 <P>Works beautifully. Thank you!</P> Tue, 09 Jul 2024 22:11:18 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-by-field-with-search/m-p/692828#M235806 Idodox 2024-07-09T22:11:18Z