Splunk Search

How do you divide values in a field?

acabrera1
Explorer

I have the following search string:

index=other_gomez sourcetype=other_gomez_avail http://myreports.yellowpages.ca/ earliest=-2w-2d latest=-2d | eval Date=if(_time>relative_time(now(),"-1w-2d"),"this_week","last_week") | chart count over pagestatus by Date  | table pagestatus last_week this_week | addcoltotals | eval pagestatus=if(isnull(pagestatus),"TOTAL",pagestatus) | fields pagestatus,last_week,this_week | rename pagestatus as "Page Status" last_week as "Last week" this_week as "This week" 

I'm trying to calculate the percentage failed for this week and last week (FAIL/TOTAL).
How can I divide values in the same field?

Tags (2)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use appendpipe to calculate the fraction of "FAIL" over "TOTAL" per week from the table and append a new row:

| appendpipe [chart eval(100*sum(eval(if(pagestatus=="FAIL", "Last week", 0)))/sum(eval(if(pagestatus=="TOTAL", "Last week", 0)))) as "Last week" eval(100*sum(eval(if(pagestatus=="FAIL", "This week", 0)))/sum(eval(if(pagestatus=="TOTAL", "This week", 0)))) as "This week" | eval "Page Status" = "Failure percent"]

acabrera1
Explorer

appendpipe! I never knew there was such a command and it worked! Thanks so much for your help!!

0 Karma
Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...