Percent problems

[jacqu3sy]

Hi,

Struggling to get the percentage to work properly...

I have 3 fields; Open, Closed and New.

I want to report on the percentage of events which have a status of either Closed or Open.

Trying to play with the following but cant get it working;

| eval actioned=if(in(status_group,"Open", "Closed"),"true","false")
| stats count by actioned
| eventstats sum(count) as total
| eval percent= round ( count*100/total,1)
| gauge percent 0 40 60 100
| fillnull value=0

Any ideas? Thanks.

[lakshman239]

You could do something like the below, as you are interested in Open/Closed only

| eval percent= round ( if(actioned="true",count*100/total,0),1) | search percent > 0  
| gauge percent 0 40 60 100 
| fillnull value=0