Splunk Search

How to calculate successful percentage grouped by another field?

csahoo
Explorer
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try (and may be post your question as text instead of picture next time😁 )

Your Base search
| where status="Received" OR status="Success"
| stats count(eval(status="Received")) as Received count(eval(status="Success")) as Success by sourceNodeCode labelType
| eval SuccessRate=round((Success*100)/ Received,2)
| stats list(labelType) as labelType list(Received) as GenerationCount list(SuccessRate) as "SuccessRate%" by sourceNodeCode

  

View solution in original post

csahoo
Explorer

Thank you very much  @ITWhisperer @somesoni2 both the queries are working fine

0 Karma

somesoni2
Revered Legend

Give this a try (and may be post your question as text instead of picture next time😁 )

Your Base search
| where status="Received" OR status="Success"
| stats count(eval(status="Received")) as Received count(eval(status="Success")) as Success by sourceNodeCode labelType
| eval SuccessRate=round((Success*100)/ Received,2)
| stats list(labelType) as labelType list(Received) as GenerationCount list(SuccessRate) as "SuccessRate%" by sourceNodeCode

  

ITWhisperer
SplunkTrust
SplunkTrust

ITWhisperer_0-1652286765400.png

 

Get Updates on the Splunk Community!

Index This | When is October more than just the tenth month?

October 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What’s New & Next in Splunk SOAR

 Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us for an ...