Splunk Search

Adding a percentage Failure column to a table from a chart command

zd00191
Communicator

I have the following search.

index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status |rename System as "Application" |sort 0 -FAILURE |addtotals fieldname=Total

This search creates a table with a total column and a column for each status. Each column contains a numerical value which is a count. I would like to add a column that will show the percentage of the 'Total' column that the FAILURE column count is . For example if the Total column for SAP FILO is 100 and the failure column value is 20. I wan to have another column that will have 20%. Please help! Thanks!

0 Karma
1 Solution

woodcock
Esteemed Legend

OK, given your clarification, like this:

 index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status |rename System as "Application" | sort 0 -FAILURE | addtotals fieldname=Total | eval pct=100*FAILURE/Total

View solution in original post

woodcock
Esteemed Legend

OK, given your clarification, like this:

 index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status |rename System as "Application" | sort 0 -FAILURE | addtotals fieldname=Total | eval pct=100*FAILURE/Total

woodcock
Esteemed Legend

Like this:

index=ko_autosys sourcetype=autosys_applog_scheduler_events  host="usatlb98" OR host="usatlb91" System="*"  JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status |rename System as "Application" | addcoltotals | fillnull value="Total" | eval rowTotal=0 | foreach * [eval rowTotal = rowTotal + if(isnum(<<FIELD>>),<<FIELD>>,0)] | sort 6 - rowTotal | eventstats first(rowTotal) AS allTotal | eval pct = 100*rowTotal/allTotal |sort 0 -FAILURE
0 Karma

zd00191
Communicator

Thank you again for helping me.

The table should contain 20 rows with the last row being a sum of the column values. There should be 6 columns with the last column containing a total of the row. I would like to have a column that displays a percentage of the total that is in the FAILURE column. These should be the column separated by a space

Application FAILURE RESTART SUCCESS TERMINATED Total PercentFailure

0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...