Splunk Search

How do you divide values in a field?

acabrera1
Explorer

I have the following search string:

index=other_gomez sourcetype=other_gomez_avail http://myreports.yellowpages.ca/ earliest=-2w-2d latest=-2d | eval Date=if(_time>relative_time(now(),"-1w-2d"),"this_week","last_week") | chart count over pagestatus by Date  | table pagestatus last_week this_week | addcoltotals | eval pagestatus=if(isnull(pagestatus),"TOTAL",pagestatus) | fields pagestatus,last_week,this_week | rename pagestatus as "Page Status" last_week as "Last week" this_week as "This week" 

I'm trying to calculate the percentage failed for this week and last week (FAIL/TOTAL).
How can I divide values in the same field?

Tags (2)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use appendpipe to calculate the fraction of "FAIL" over "TOTAL" per week from the table and append a new row:

| appendpipe [chart eval(100*sum(eval(if(pagestatus=="FAIL", "Last week", 0)))/sum(eval(if(pagestatus=="TOTAL", "Last week", 0)))) as "Last week" eval(100*sum(eval(if(pagestatus=="FAIL", "This week", 0)))/sum(eval(if(pagestatus=="TOTAL", "This week", 0)))) as "This week" | eval "Page Status" = "Failure percent"]

acabrera1
Explorer

appendpipe! I never knew there was such a command and it worked! Thanks so much for your help!!

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...