I have the following query. The key TEST_DECISION has 4x possible outcomes. CALL_FAILED, VALID, INVALID, NOT_CALLED.
ns=test* TEST_DECISION
PRODUCT IN (SAMPLE_123)
| timechart span=5m limit=0 count by TEST_DECISION
The output is as follows:
_time CALL_FAILED VALID INVALID NOT_CALLED
2020-04-14T05:50:00.000-0700 11 83 7 46
2020-04-14T05:55:00.000-0700 6 60 6 42
2020-04-14T06:00:00.000-0700 8 78 19 55
2020-04-14T06:05:00.000-0700 11 86 19 59
2020-04-14T06:10:00.000-0700 10 94 17 71
2020-04-14T06:15:00.000-0700 8 67 17 63
2020-04-14T06:20:00.000-0700 2 19 4 17
Is there a way I could show % instead? I only care about VALID and INVALID.
Thus I want to get the following instead.
For first row 100% will be 83(valid) + 7(invalid)
Thus I want to achieve following
VALID INVALID
92.22% 7.77%
Please advice if there is a way I could achieve this. Thank you.
Add this
| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total
Add this
| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total