Splunk Search

How to display percentage of items passed over each week

wjmaxwe2
New Member

SOURCE CODE | eventstats count(eval(errorCount=0)) AS passed, count(shortVIN) AS total | timechart span=1w@w0 eval((passed/total)*100) AS percentPassed

 

I get a message saying "expression has no fields" on the timechart. I am unsure which expression to use to display week 1's percentage, then week 2's percentage, and so on. 

 

Any help is appreciated

Labels (4)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

I think this should work for you

| timechart span=1w@w0 count(eval(errorCount=0)) AS passed count(shortVIN) AS total
| eval PercentPassed=round(passed/total*100,2)

 You count the weekly values in the timechart command and then calculate the percentage after the timechart is done.

 

0 Karma
Get Updates on the Splunk Community!

Accelerating Observability as Code with the Splunk AI Assistant

We’ve seen in previous posts what Observability as Code (OaC) is and how it’s now essential for managing ...

Integrating Splunk Search API and Quarto to Create Reproducible Investigation ...

 Splunk is More Than Just the Web Console For Digital Forensics and Incident Response (DFIR) practitioners, ...

Congratulations to the 2025-2026 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...