Splunk Search

How to add new column to chart with success rate of other columns

gsolomon11
New Member

I'm using the following search to generate the table below:

rex "<status>(?<status>.*?)<"|
search status=Incomplete OR    status=Complete OR status=Fail* |
count(status) by cRegion status

alt text

I'd like to create a fifth column which calulates the SuccessRate for each cRegion like this:

(Complete-(Failed+Incomplete)) / (Complete + Failed + Incomplete)

alt text

I've tried an assortment of different eval and stat and table expressions but cannot figure it out. Any help would be greatly appreciated! I would like to use the chart command.

Tags (1)
0 Karma
1 Solution

rjthibod
Champion

How about this?

rex "<status>(?<status>.*?)<"
| search status=Incomplete OR status=Complete OR status=Fail* 
| chart count(status) by cRegion status
| eval SuccessRate = round((Complete - (Failed + Incomplete)) / (Complete + Failed + Incomplete), 6)

View solution in original post

rjthibod
Champion

How about this?

rex "<status>(?<status>.*?)<"
| search status=Incomplete OR status=Complete OR status=Fail* 
| chart count(status) by cRegion status
| eval SuccessRate = round((Complete - (Failed + Incomplete)) / (Complete + Failed + Incomplete), 6)

gsolomon11
New Member

Wow, thank you so much!
I didn't know Splunk would know that the Complete/Failed/Incomplete parameters in the eval statement correspond to statuses and to automatically include them in the chart.

0 Karma
Get Updates on the Splunk Community!

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...