index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) count as TotalCount count(eval(Result="SUCCESS")) as SuccessCnt count(eval(Result="FAILURE")) as FatalCnt by OperationName |eval FailurePercentage= (FatalCnt*100/TotalCount)
Try this:
index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) count as TotalCount count(eval(Result="SUCCESS")) as SuccessCnt count(eval(Result="FAILURE")) as FatalCnt by OperationName|foreach FatalCnt* [eval FailurePercentage<<MATCHSTR>>= ('<<FIELD>>'/'TotalCount<<MATCHSTR>>')*100]
doc on foreach:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Foreach
Hi
Try this search code :
index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) as TotalCount , count(eval(Result="SUCCESS")) as SuccessCnt , count(eval(Result="FAILURE")) as FatalCnt by OperationName |eval FailurePercentage= (FatalCnt/TotalCount)*100