I'm using the following search to generate the table below:
rex "<status>(?<status>.*?)<"| search status=Incomplete OR status=Complete OR status=Fail* | count(status) by cRegion status
I'd like to create a fifth column which calulates the SuccessRate for each cRegion like this:
(Complete-(Failed+Incomplete)) / (Complete + Failed + Incomplete)
I've tried an assortment of different eval and stat and table expressions but cannot figure it out. Any help would be greatly appreciated! I would like to use the chart command.
How about this?
rex "<status>(?<status>.*?)<" | search status=Incomplete OR status=Complete OR status=Fail* | chart count(status) by cRegion status | eval SuccessRate = round((Complete - (Failed + Incomplete)) / (Complete + Failed + Incomplete), 6)
Wow, thank you so much!
I didn't know Splunk would know that the Complete/Failed/Incomplete parameters in the eval statement correspond to statuses and to automatically include them in the chart.