Splunk Search

Percentage of two values

splunkcol
Contributor

Hi

I have a field called STATUS with 2 possible values ​​"SUCCESS" or "WARNING" but the percentages don't seem to work well, I appreciate suggestions

splunkcol_1-1631197644130.png

 

index=my_index SERVICE_CODE="ABCD"
|fields STATUS, SERVICE_CODE
| timechart span=1d sum(eval(if(STATUS="SUCCESS",1,0))) as SUCCESS, sum(eval(if(STATUS="WARNING",1,0))) as FAILED, count as total
| eval percentage=round((SUCCESS/total)*100,2)
| fillnull value=0
| fields percentage
| appendpipe
[stats count
| where count=0]

 

 

Labels (3)
0 Karma
1 Solution

splunkcol
Contributor

I think I have already solved it

For SUCCESS

splunkcol_0-1631199335340.png

For FAILED

 

splunkcol_1-1631199405730.png

 

View solution in original post

0 Karma

splunkcol
Contributor

I think I have already solved it

For SUCCESS

splunkcol_0-1631199335340.png

For FAILED

 

splunkcol_1-1631199405730.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval percentage=floor((SUCCESS/total)*10000)/100
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...