Splunk Search

How do you divide values in a field?

acabrera1
Explorer

I have the following search string:

index=other_gomez sourcetype=other_gomez_avail http://myreports.yellowpages.ca/ earliest=-2w-2d latest=-2d | eval Date=if(_time>relative_time(now(),"-1w-2d"),"this_week","last_week") | chart count over pagestatus by Date  | table pagestatus last_week this_week | addcoltotals | eval pagestatus=if(isnull(pagestatus),"TOTAL",pagestatus) | fields pagestatus,last_week,this_week | rename pagestatus as "Page Status" last_week as "Last week" this_week as "This week" 

I'm trying to calculate the percentage failed for this week and last week (FAIL/TOTAL).
How can I divide values in the same field?

Tags (2)
0 Karma

Stephen_Sorkin
Splunk Employee
Splunk Employee

You can use appendpipe to calculate the fraction of "FAIL" over "TOTAL" per week from the table and append a new row:

| appendpipe [chart eval(100*sum(eval(if(pagestatus=="FAIL", "Last week", 0)))/sum(eval(if(pagestatus=="TOTAL", "Last week", 0)))) as "Last week" eval(100*sum(eval(if(pagestatus=="FAIL", "This week", 0)))/sum(eval(if(pagestatus=="TOTAL", "This week", 0)))) as "This week" | eval "Page Status" = "Failure percent"]

acabrera1
Explorer

appendpipe! I never knew there was such a command and it worked! Thanks so much for your help!!

0 Karma
Get Updates on the Splunk Community!

Federated Search for Amazon S3 | Key Use Cases to Streamline Compliance Workflows

Modern business operations are supported by data compliance. As regulations evolve, organizations must ...

New Dates, New City: Save the Date for .conf25!

Wake up, babe! New .conf25 dates AND location just dropped!! That's right, this year, .conf25 is taking place ...

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...