Percentage of two values

[splunkcol]

Hi

I have a field called STATUS with 2 possible values ​​"SUCCESS" or "WARNING" but the percentages don't seem to work well, I appreciate suggestions

index=my_index SERVICE_CODE="ABCD"
|fields STATUS, SERVICE_CODE
| timechart span=1d sum(eval(if(STATUS="SUCCESS",1,0))) as SUCCESS, sum(eval(if(STATUS="WARNING",1,0))) as FAILED, count as total
| eval percentage=round((SUCCESS/total)*100,2)
| fillnull value=0
| fields percentage
| appendpipe
[stats count
| where count=0]

[splunkcol · Accepted solution]

I think I have already solved it

For SUCCESS

For FAILED

[ITWhisperer]

| eval percentage=floor((SUCCESS/total)*10000)/100