Query to get top 5 failures

[s_kandula]

I have events being sent to Splunk which will have the following fields
MsgID, Status(Failure/Success)
I need to get the list of top 5 MsgIDs with maximum failures. And display each of the 5 MsgIDs in a pie chart, with success and failure percentages.

I am able to get the top 5 failures, but unable to figure out how to get both success and faliures as percentages for top 5 failures.
Please help

[richgalloway · Accepted solution]

This query will give you successes and failures as percentages, but I don't know a way to get both into the same pie chart.

... | stats count as Total, count(eval(Status=="Failure")) as Failures, count(eval(Status=="Success")) as Successes by MsgID
| sort 5 - Failures
| eval PctFailure = Failures * 100 / Total, PctSuccess = Successes * 100 / Total
| chart PctFailure by MsgID