https://community.splunk.com/t5/Splunk-Search/Why-is-fieldformat-not-working-if-I-don-t-include-a-certain/m-p/285176#M86257 <P>here is my search, I'm trying to create a report that shows the <STRONG>error count</STRONG>, <STRONG>error percentage</STRONG>, and <STRONG>total transaction count</STRONG>...</P> <PRE><CODE>| dedup TransactionID | stats count As ErrorCount by TransactionName | appendcols [search Message="Calling ProcessRequest" | stats count as TotalTransactionCount by TransactionName ]|eval ErrorPerc= if (isnull(ErrorCount), 0, ErrorCount/TotalTransactionCount) | fieldformat ErrorPercentage = tostring(round(ErrorPerc,6)*100)."%" | Table TransactionName ErrorPercentage ErrorCount ErrorPerc TotalTransactionCount | fillnull value=0 | sort -ErrorCount </CODE></PRE> <P>If I don't include <STRONG>ErrorPerc</STRONG> in the table, <STRONG>ErrorPercentage</STRONG> shows up as null. I really don't want <STRONG>ErrorPerc</STRONG> in there since it's less readable and a duplicate of <STRONG>ErrorPercentage</STRONG></P> <P>Dan</P> Thu, 15 Sep 2016 14:50:10 GMT danoconnl 2016-09-15T14:50:10Z https://community.splunk.com/t5/Splunk-Search/Why-is-fieldformat-not-working-if-I-don-t-include-a-certain/m-p/285176#M86257 <P>here is my search, I'm trying to create a report that shows the <STRONG>error count</STRONG>, <STRONG>error percentage</STRONG>, and <STRONG>total transaction count</STRONG>...</P> <PRE><CODE>| dedup TransactionID | stats count As ErrorCount by TransactionName | appendcols [search Message="Calling ProcessRequest" | stats count as TotalTransactionCount by TransactionName ]|eval ErrorPerc= if (isnull(ErrorCount), 0, ErrorCount/TotalTransactionCount) | fieldformat ErrorPercentage = tostring(round(ErrorPerc,6)*100)."%" | Table TransactionName ErrorPercentage ErrorCount ErrorPerc TotalTransactionCount | fillnull value=0 | sort -ErrorCount </CODE></PRE> <P>If I don't include <STRONG>ErrorPerc</STRONG> in the table, <STRONG>ErrorPercentage</STRONG> shows up as null. I really don't want <STRONG>ErrorPerc</STRONG> in there since it's less readable and a duplicate of <STRONG>ErrorPercentage</STRONG></P> <P>Dan</P> Thu, 15 Sep 2016 14:50:10 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-fieldformat-not-working-if-I-don-t-include-a-certain/m-p/285176#M86257 danoconnl 2016-09-15T14:50:10Z https://community.splunk.com/t5/Splunk-Search/Why-is-fieldformat-not-working-if-I-don-t-include-a-certain/m-p/285177#M86258 <P>Try this</P> <PRE><CODE>| dedup TransactionID | stats count As ErrorCount by TransactionName | appendcols [search Message="Calling ProcessRequest" | stats count as TotalTransactionCount by TransactionName ]|eval ErrorPercentage = if (isnull(ErrorCount), 0, ErrorCount/TotalTransactionCount) | fieldformat ErrorPercentage=tostring(round(ErrorPercentage,6)*100)."%" | Table TransactionName ErrorPercentage ErrorCount TotalTransactionCount | fillnull value=0 | sort -ErrorCount </CODE></PRE> Thu, 15 Sep 2016 16:26:30 GMT https://community.splunk.com/t5/Splunk-Search/Why-is-fieldformat-not-working-if-I-don-t-include-a-certain/m-p/285177#M86258 sundareshr 2016-09-15T16:26:30Z