https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timeseries-that-is-derived-by-dividing-similar/m-p/176185#M50591 <P>Hi,</P> <PRE><CODE>index= .... | bucket span=1h _time | stats count(client_ip) as Calls count(IPAddress) AS Fails |timechart per_hour(eval(Fails/Calls*100)) as Percent_Fails </CODE></PRE> Wed, 18 Mar 2015 10:32:51 GMT btt 2015-03-18T10:32:51Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timeseries-that-is-derived-by-dividing-similar/m-p/176184#M50590 <P>Once search query allows me to get the total percentage of failed calls in a 24 hour window</P> <PRE><CODE>index= ... | stats count(client_ip) as Calls | appendcols [ search index=... | stats count(IPAddress) AS Fails] | eval "Percent Fails"=Fails/Calls*100 </CODE></PRE> <P>If I put the base searches of each the above two searches into the variables A and B, I get</P> <PRE><CODE> A | stats count(client_ip) as Calls | appendcols [ B | stats count(IPAddress) AS Fails] | eval "Percent Fails"=Fails/Calls*100 </CODE></PRE> <P>I can also create a timeseries for the number of calls and the number of fails by the following</P> <PRE><CODE>A | timechart count span=1h B | timechart count span=1h </CODE></PRE> <P>Is there a way that I can combine the two? I want to be able to get a timeseries of the percentage of failed calls per hour over the last 24 hours.</P> <P>Essentially, this would equate to taking each hour in B and dividing it by the same hour in A. Does anyone have any idea of how to do this? </P> <P>Thanks!</P> Thu, 12 Mar 2015 22:00:16 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timeseries-that-is-derived-by-dividing-similar/m-p/176184#M50590 Splunkster45 2015-03-12T22:00:16Z https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timeseries-that-is-derived-by-dividing-similar/m-p/176185#M50591 <P>Hi,</P> <PRE><CODE>index= .... | bucket span=1h _time | stats count(client_ip) as Calls count(IPAddress) AS Fails |timechart per_hour(eval(Fails/Calls*100)) as Percent_Fails </CODE></PRE> Wed, 18 Mar 2015 10:32:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-a-timeseries-that-is-derived-by-dividing-similar/m-p/176185#M50591 btt 2015-03-18T10:32:51Z