How to add if clause in a foreach eval [ statement for the following query?

[djoobbani]

Dear splunk community:

I have the following search query which basically shows the number of counts and percentage of url (Y-Axis) http status code (X-Axis):

<basic search> | chart count by url, http_status_code | addtotals fieldname=total
| foreach 2* 3* 4* 5* [ eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total), "<<FIELD>>"='<<FIELD>>'." (".'percent_<<FIELD>>'."%)" ] | fields - percent_* total

Here is a sample of the above query result:

Now, i need to insert an if clause so that if the percentage is either 0 OR 100, then do NOT display the percentage. How would i do that to the above query to get this result?

Thank you very much for your help!

[richgalloway · Accepted solution]

Untested, but perhaps this will do.

| foreach 2* 3* 4* 5* [ 
  eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total),
    "<<FIELD>>"=if('<<FIELD>>'=0 OR '<<FIELD>>'=100, '<<FIELD>>','<<FIELD>>'." (".'percent_<<FIELD>>'."%)")
  ] | 

[djoobbani]

Thanks richgalloway for your quick reply.

This worked half-way. So now i don't see any 0% percent anymore, but it still shows 100%.

Thanks!