Calculate percent

[C37996518]

index=Myindex sourcetype=mine mysearch    | eval Result=if(Apple="1","Bad","Good")
| stats count by Result

The search above gives me the correct count of events where Apple="1"

eg

Result                                                 Count

Bad                                                       5 

Good                                                  12392

How do I express the stats as a  single value in percentage ie  Bad/Good?

How do I alert  if the percentage  > .02%

[C37996518]

---

@C37996518 wrote:

index=Myindex sourcetype=mine mysearch    | eval Result=if(Apple="1","Bad","Good")
| stats count by Result

The search above gives me the correct count of events where Apple="1"

eg

Result                                                 Count

Bad                                                       5 

Good                                                  12392

How do I express the stats as a  single value in percentage ie  Bad/Good?

How do I alert  if the percentage  > .02%

---

Thanks to both. Perfect!!

[bowesmana · Accepted solution]

NB: and on a slight technical note to ITWhispers comments, if you're looking for bad as a % of total rather than of goodNB, then

| eval percent=100*Bad/(Bad+Good)

[ITWhisperer]

index=Myindex sourcetype=mine mysearch
| eval Bad=if(Apple="1",1,0)
| eval Good=if(Apple="1",0,1)
| stats sum(Bad) as Bad sum(Good) as Good
| eval percent=100*Bad/Good
| where percent>0.02

The last line is for the alert so that you only get results when the percentage is greater than 0.02