Hi
I have a field called STATUS with 2 possible values "SUCCESS" or "WARNING" but the percentages don't seem to work well, I appreciate suggestions
index=my_index SERVICE_CODE="ABCD"
|fields STATUS, SERVICE_CODE
| timechart span=1d sum(eval(if(STATUS="SUCCESS",1,0))) as SUCCESS, sum(eval(if(STATUS="WARNING",1,0))) as FAILED, count as total
| eval percentage=round((SUCCESS/total)*100,2)
| fillnull value=0
| fields percentage
| appendpipe
[stats count
| where count=0]
I think I have already solved it
For SUCCESS
For FAILED
| eval percentage=floor((SUCCESS/total)*10000)/100