topic Adding a percentage Failure column to a table from a chart command in Splunk Search

Adding a percentage Failure column to a table from a chart command

zd00191 — Fri, 31 Jul 2015 02:49:53 GMT

I have the following search.

index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status |rename System as "Application" |sort 0 -FAILURE |addtotals fieldname=Total

This search creates a table with a total column and a column for each status. Each column contains a numerical value which is a count. I would like to add a column that will show the percentage of the 'Total' column that the FAILURE column count is . For example if the Total column for SAP FILO is 100 and the failure column value is 20. I wan to have another column that will have 20%. Please help! Thanks!

Re: Adding a percentage Failure column to a table from a chart command

woodcock — Fri, 31 Jul 2015 03:20:55 GMT

Like this:

index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status |rename System as "Application" | addcoltotals | fillnull value="Total" | eval rowTotal=0 | foreach * [eval rowTotal = rowTotal + if(isnum(<<FIELD>>),<<FIELD>>,0)] | sort 6 - rowTotal | eventstats first(rowTotal) AS allTotal | eval pct = 100*rowTotal/allTotal |sort 0 -FAILURE

Re: Adding a percentage Failure column to a table from a chart command

zd00191 — Fri, 31 Jul 2015 03:27:32 GMT

Thank you again for helping me.

The table should contain 20 rows with the last row being a sum of the column values. There should be 6 columns with the last column containing a total of the row. I would like to have a column that displays a percentage of the total that is in the FAILURE column. These should be the column separated by a space

Application FAILURE RESTART SUCCESS TERMINATED Total PercentFailure

Re: Adding a percentage Failure column to a table from a chart command

woodcock — Fri, 31 Jul 2015 14:52:27 GMT

OK, given your clarification, like this:

 index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status |rename System as "Application" | sort 0 -FAILURE | addtotals fieldname=Total | eval pct=100*FAILURE/Total