Alert condition to trigger 51% of failure responses

[Mahasplunk]

Hi,

 I need to have  Splunk alert condition trigger email alert where  If 51%  of failure occurred out of total (success + failures ) no. of responses over period of time interval.()

For Ex:  If Splunk get total response = 10

      if failure response count >=6(more than 50% of total no. of response) then trigger alert.(Success count is 4 or less)

[richgalloway]

What is your question?

If you're trying to calculate the failure percentage then what have you tried so far?

[Mahasplunk]

I have tried to get the total response count and then try get the % of failure to check if its >51.. could you please provide the better approach

| stats count(eval(match(Type,"FAILURE"))) as f count as fc | stats count(eval(match(Type,"SUCCESS"))) as s count as sc |eval t=fc+sc|eval perF=((fc/t)*100 ,2)| where perF>51 

[richgalloway]

You have the general idea.  The second stats command won't work as expected because the first has transformed the results.  You can combine them, however, in this case the second is not needed.

| stats count(eval(match(Type,"FAILURE"))) as fc, count as t
| eval perF=round((fc*100)/t, 2)
| where perF>51