Count Occurrences of a string in all columns dynamically

[dgadjov]

The goal is just to have the percentage pass rate at the bottom of a dynamically named column that contains "Passed" or "Failed"

I have a table that contains 8 column headers that are dynamic and will be constantly be changing.
The content in the column will always be the same "Pass" or "Fail". I want to get the percent pass rate for a column and append it to the bottom. What I have so far is:

 ...| appendpipe [ stats count(*="Passed") as *_pass, count(*) as total_* | eval *=round(*_pass*100/total_*,2)]

I know the eval statement won't work because the wildcard will be considered multiplication.
Also the count(*="Passed") line will not evaluate without errors.

[martin_mueller · Accepted solution]

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

[dgadjov]

The replace "failed" with 0 and "Passed" with 100 is what I needed. After that I can just use the average function and revert the numbers back to pass fail.

[dgadjov]

This almost works. There is one thing I forgot to mention. Sometimes the cell maybe empty. The scale function is applying scale on all column based off the one scalar value. Since each column has a different count the percent in columns with an empty cell are wrong.