Splunk Search

Transpose & Calculated Field from Eval

hollybross1219
Path Finder

hello! This is probably a simple answer that I'm not understanding.

Running the query below will add a column at the very end called "success_rate". I don't want this since, since I've transposed that field to the first row. Seems like the eval from line 4 is still trying to calculate...? How do I get rid of it? | field - success_rate doesn't work 😞

index=wsi_tax_summary sourcetype=stash partnerId=* error_msg_service=* tax_year=2019 capability=* intuit_tid=* capability=* 
| eval error_msg_service = case(match(error_msg_service, "OK"), "Success", 1==1, "Fail") 
| timechart span=1w dc(intuit_tid) by error_msg_service 
| fillnull 
| eval total=Fail+Success, success_rate=round(((Success/total)*100),2) 
| fieldformat success_rate=tostring('success_rate')+"%" 
| fields _time, total, Success, Fail, success_rate 
| eval _time=strftime(_time,"%m-%d-%Y") 
| transpose column_name="Week Starting" header_field=_time 
| regex "Week Starting"!=("^_")
| fields - success_rate

alt text

0 Karma
1 Solution

hollybross1219
Path Finder

I figured it out. It's the fieldformat that's the constraint. I removed it and I achieved what I wanted.

View solution in original post

0 Karma

hollybross1219
Path Finder

I figured it out. It's the fieldformat that's the constraint. I removed it and I achieved what I wanted.

0 Karma
Get Updates on the Splunk Community!

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...