Splunk Search

How to add a percentage column to a table

vshakur
Path Finder

I have a query that ends with:

| chart count by  suite_name, status

suite_name consists of many events with a status of either FAIL or PASS.
I get a table with the header: | suite_name | FAIL | PASS |
The table displays the total number of fails and passes for each suite name.
I would like to add a percentage column that would represent for each row (each suite name) the passing rate: (pass*100)/(pass+fail)

How do I do that?

Thanks,
Samuel

Tags (3)
0 Karma
1 Solution

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

View solution in original post

woodcock
Esteemed Legend

You can just use | top suite_name BY status instead or you can add this to the end:

| addtotals row=t col=f
| rename Total AS _total
| foreach * [eval "<<FIELD>>_PCT"=if(isnum('<<FIELD>>'), 100*'<<FIELD>>'/_total, null())]

OR better yet use this last line instead:

| foreach * [eval "<<FIELD>>"=if(isnum('<<FIELD>>'), '<<FIELD>>' . "(" . 100*'<<FIELD>>'/_total . "%)", '<<FIELD>>')]
0 Karma

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

Get Updates on the Splunk Community!

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...