Splunk Search

How to make timechart with ratio failed/total ?

AnaSpiStats
Engager

This is my search:

message_data_type=gd*| timechart count by message_data_type limit=10

These are my results:

AnaSpiStats_0-1684848039033.png

But I need to create a timechart of the  failed/total events ratio.

How can I do that ?

Labels (2)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| timechart count by message_data_type
| addtotals col=f row=t
| eval failedratio=failed/Total
| fields _time failedratio Total

View solution in original post

AnaSpiStats
Engager

failed/Total events 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| timechart count by message_data_type
| addtotals col=f row=t
| eval failedratio=failed/Total
| fields _time failedratio Total

ITWhisperer
SplunkTrust
SplunkTrust

Is that what you really want to do? What if there are zero failed events - Success/zero is infinity, or Failed/zero is infinity if there are zero Success events?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...