Splunk Search

Percentage of two values

splunkcol
Builder

Hi

I have a field called STATUS with 2 possible values ​​"SUCCESS" or "WARNING" but the percentages don't seem to work well, I appreciate suggestions

splunkcol_1-1631197644130.png

 

index=my_index SERVICE_CODE="ABCD"
|fields STATUS, SERVICE_CODE
| timechart span=1d sum(eval(if(STATUS="SUCCESS",1,0))) as SUCCESS, sum(eval(if(STATUS="WARNING",1,0))) as FAILED, count as total
| eval percentage=round((SUCCESS/total)*100,2)
| fillnull value=0
| fields percentage
| appendpipe
[stats count
| where count=0]

 

 

Labels (3)
0 Karma
1 Solution

splunkcol
Builder

I think I have already solved it

For SUCCESS

splunkcol_0-1631199335340.png

For FAILED

 

splunkcol_1-1631199405730.png

 

View solution in original post

0 Karma

splunkcol
Builder

I think I have already solved it

For SUCCESS

splunkcol_0-1631199335340.png

For FAILED

 

splunkcol_1-1631199405730.png

 

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| eval percentage=floor((SUCCESS/total)*10000)/100
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...