Dear Splunk Community:
I have the following search query:
<Basic_Search> | chart count by path_template, http_status_code | addtotals fieldname=total
| foreach 2* 3* 4* 5* [ eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total,2),
"<<FIELD>>"=if('<<FIELD>>'=0 , '<<FIELD>>', '<<FIELD>>'." (".'percent_<<FIELD>>'."%)")] | fields - percent_* total 2* 3* 4*
Attached is the screen result of the above query which shows the 500s columns.
I need to modify the above search so that it only displays the numbers where the percentage is great than 0.01%. How do i do that?
Thanks!
Change the foreach statement to do this
[ eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total,2),
"<<FIELD>>"=case('<<FIELD>>'=0 , '<<FIELD>>', 'percent_<<FIELD>>'>0.01, '<<FIELD>>'." (".'percent_<<FIELD>>'."%)", true(), null())]
i.e the percentage threshold of 0.01 or above will allow the value to be shown, otherwise it will clear it
Change the foreach statement to do this
[ eval "percent_<<FIELD>>"=round(100*'<<FIELD>>'/total,2),
"<<FIELD>>"=case('<<FIELD>>'=0 , '<<FIELD>>', 'percent_<<FIELD>>'>0.01, '<<FIELD>>'." (".'percent_<<FIELD>>'."%)", true(), null())]
i.e the percentage threshold of 0.01 or above will allow the value to be shown, otherwise it will clear it
Thank you!
You rock, thanks this works!