https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30473#M6179 <P>Test to see if succeeded_count and task count are actually numbers. Other than that, I cannot see why this would not work</P> Fri, 09 Aug 2013 13:41:54 GMT davecroto 2013-08-09T13:41:54Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30471#M6177 <P>I'm doing something wrong here.. . I have the following search</P> <PRE><CODE>...| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio &lt; 98 | sort SuccessRatio </CODE></PRE> <P>I'm trying to filter out anything that has a SuccessRatio of greater than 98% but its not working I'm still getting results that have 100% success.</P> Fri, 09 Aug 2013 13:06:47 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30471#M6177 tb5821 2013-08-09T13:06:47Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30472#M6178 <P>*|eval succeeded_count=99 |eval task_count=1| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio &lt; 98 | sort SuccessRatio</P> <P>vs</P> <P>*|eval succeeded_count=20 |eval task_count=1| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio &lt; 98 | sort SuccessRatio</P> <P>Seems to work for the above</P> Mon, 28 Sep 2020 14:32:14 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30472#M6178 davecroto 2020-09-28T14:32:14Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30473#M6179 <P>Test to see if succeeded_count and task count are actually numbers. Other than that, I cannot see why this would not work</P> Fri, 09 Aug 2013 13:41:54 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30473#M6179 davecroto 2013-08-09T13:41:54Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30474#M6180 <P>Did you ever get this to work?</P> Fri, 09 Aug 2013 15:23:28 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30474#M6180 davecroto 2013-08-09T15:23:28Z https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30475#M6181 <P>because you appended "%" to the number before filtering, making it a string (not a number). SuccessRatio is not a number, it's a string. eval, filter, sort, and <EM>then</EM> format it:</P> <PRE><CODE> ... | eval SuccessRatio = round(100*succeeded_count/task_count) | where SuccessRatio &lt; 98 | sort SuccessRatio | eval SuccessRatio = SuccessRatio . "%" </CODE></PRE> Sat, 10 Aug 2013 00:04:41 GMT https://community.splunk.com/t5/Splunk-Search/Using-Eval-where/m-p/30475#M6181 gkanapathy 2013-08-10T00:04:41Z