Now I have a table like below.
ID, Result, SerNum, Place
1, success, AAAAA, XXXXX
2, success, BBBBB, YYYYY
3, failure, CCCCC, YYYYY
4, success, CCCCC, YYYYY
Now I want to get below results for each place with one search, then what will be the search strings?
Table of Result should be like below.
Place, Failed SerNum, Success Rate
XXXXX, 0, 100%
YYYYY, 1, 66.6%
Please advise.
Try this.
<your search terms>
| chart dc(SerNum) as failedSerNum over Place by Result
| fillnull success failure value=0
| eval SuccessRate=success/(success+failure)
| eval SuccessRate=SuccessRate+"%"
| table Place FailedSerNum SuccessRate
The command doing the work here is the chart command. If you deleted everything after the chart command, what you'd see it's output to be would be:
Result success failure
XXXX 1 0
YYYY 2 1
Thank you for your answer, but in this case what I really want for SuccessRate is rate of transations, not of cards.
When the table is changed as below(Result of ID4 became failure), your search strings get "YYYYY:50%" as SuccessRate, but it should be "YYYYY:66.6%".
ID, Result, SerNum, Place
1, success, AAAAA, XXXXX
2, success, BBBBB, YYYYY
3, failure, CCCCC, YYYYY
4, failure, CCCCC, YYYYY
Do you still have solution about this? I am really sorry, my former example was too bad.
OK. If I understand right, then you would just change the dc(SerNum) part, to "count".
<your search terms>
| chart count over Place by Result
| fillnull success failure value=0
| eval SuccessRate=success/(success+failure)
| eval SuccessRate=SuccessRate+"%"
| table Place FailedSerNum SuccessRate
PS I also saw that you voted down my answer which seems weird. On this site downvotes are more reserved for poorly written, incomplete or misleading answers.