How to build a Splunk search to build a table for PASS and FAIL percentage?

[super_edition]

Hello Everyone,

This is the extension of previous query which I posted- https://community.splunk.com/t5/Splunk-Search/How-would-I-write-a-Splunk-search-to-build-a-table-for...

Thanks to @ITWhisperer  and updated query worked well.

Now I am trying to add percentage column for PASS and FAIL, instead of the count:

_time	success	fail
2023-05-28 03:00	98	2
2023-05-28 04:00	60	40
2023-05-28 05:00	100	0

I was trying to build a query, something like this:

index=my_index sourcetype=openshift_logs openshift_namespace=my_ns  openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*) 
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES 
| search "message.url"="/shopping/carts/*"  
```| timechart span=1h dc("message.tracers.ek-correlation-id{}") as count by status```
| eventstats count("message.tracers.ek-correlation-id{}") as totalCount
| eventstats count("message.tracers.ek-correlation-id{}") as individualCount by status
| eval percent=(individualCount/totalCount)*100

I know the above query is incomplete and not sure if this the right way to proceed.

[ITWhisperer]

Instead of the last 3 lines, try this

| addtotals
| eval successpercent=100*success/Total

[super_edition]

Hello @ITWhisperer 

I am getting the below data as the result:

index=my_index sourcetype=openshift_logs openshift_namespace=my_ns  openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*) 
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES 
| search "message.url"="/shopping/carts/*"
| timechart span=1h dc("message.tracers.correlation-id{}") as count by status pct
| addtotals
| eval successpercent=round(100*success/Total,1)
| eval failpercent=round(100*fail/Total,1)

But I am looking for only successpercent and failpercent to be displayed in the table.

[ITWhisperer · Accepted solution]

Just overwrite the success and fail fields

index=my_index sourcetype=openshift_logs openshift_namespace=my_ns  openshift_cluster="cluster009"
("message.statusCode"=2* OR "message.statusCode"=4*) 
| eval status=if('message.statusCode'>300,"fail","success")
| search "message.logType"=CLIENT_RES 
| search "message.url"="/shopping/carts/*"
| timechart span=1h dc("message.tracers.correlation-id{}") as count by status pct
| addtotals
| eval success=round(100*success/Total,1)
| eval fail=round(100*fail/Total,1)

[super_edition]

this command helped:

|fields _time successpercent failpercent