how to calculate percentage in timechart by?

[karthi2809]

index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) count as TotalCount count(eval(Result="SUCCESS")) as SuccessCnt count(eval(Result="FAILURE")) as FatalCnt by OperationName |eval FailurePercentage= (FatalCnt*100/TotalCount)

[cmerriman]

Try this:

index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName)))) count as TotalCount count(eval(Result="SUCCESS")) as SuccessCnt count(eval(Result="FAILURE")) as FatalCnt by OperationName|foreach FatalCnt* [eval FailurePercentage<<MATCHSTR>>= ('<<FIELD>>'/'TotalCount<<MATCHSTR>>')*100]

doc on foreach:
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/Foreach

[chimell]

Hi

Try this search code :

index=xxx|transaction transid startswith="Request" endswith="Response" Keeporphans=t |timechart avg((count(eval(Result="FAILURE"))/count(eval(OperationName))))  as TotalCount , count(eval(Result="SUCCESS")) as SuccessCnt , count(eval(Result="FAILURE")) as FatalCnt by OperationName |eval FailurePercentage= (FatalCnt/TotalCount)*100