Splunk Search

How to add a percentage column to a table

vshakur
Path Finder

I have a query that ends with:

| chart count by  suite_name, status

suite_name consists of many events with a status of either FAIL or PASS.
I get a table with the header: | suite_name | FAIL | PASS |
The table displays the total number of fails and passes for each suite name.
I would like to add a percentage column that would represent for each row (each suite name) the passing rate: (pass*100)/(pass+fail)

How do I do that?

Thanks,
Samuel

Tags (3)
0 Karma
1 Solution

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

View solution in original post

woodcock
Esteemed Legend

You can just use | top suite_name BY status instead or you can add this to the end:

| addtotals row=t col=f
| rename Total AS _total
| foreach * [eval "<<FIELD>>_PCT"=if(isnum('<<FIELD>>'), 100*'<<FIELD>>'/_total, null())]

OR better yet use this last line instead:

| foreach * [eval "<<FIELD>>"=if(isnum('<<FIELD>>'), '<<FIELD>>' . "(" . 100*'<<FIELD>>'/_total . "%)", '<<FIELD>>')]
0 Karma

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...