Splunk Search
Highlighted

How to add a percentage column to a table

Path Finder

I have a query that ends with:

| chart count by  suite_name, status

suite_name consists of many events with a status of either FAIL or PASS.
I get a table with the header: | suite_name | FAIL | PASS |
The table displays the total number of fails and passes for each suite name.
I would like to add a percentage column that would represent for each row (each suite name) the passing rate: (pass*100)/(pass+fail)

How do I do that?

Thanks,
Samuel

Tags (3)
0 Karma
Highlighted

Re: How to add a percentage column to a table

Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

View solution in original post

Highlighted

Re: How to add a percentage column to a table

Esteemed Legend

You can just use | top suite_name BY status instead or you can add this to the end:

| addtotals row=t col=f
| rename Total AS _total
| foreach * [eval "<<FIELD>>_PCT"=if(isnum('<<FIELD>>'), 100*'<<FIELD>>'/_total, null())]

OR better yet use this last line instead:

| foreach * [eval "<<FIELD>>"=if(isnum('<<FIELD>>'), '<<FIELD>>' . "(" . 100*'<<FIELD>>'/_total . "%)", '<<FIELD>>')]
0 Karma