Splunk Search

Transpose & Calculated Field from Eval

Path Finder

hello! This is probably a simple answer that I'm not understanding.

Running the query below will add a column at the very end called "successrate". I don't want this since, since I've transposed that field to the first row. Seems like the eval from line 4 is still trying to calculate...? How do I get rid of it? `| field - successrate` doesn't work 😞

index=wsi_tax_summary sourcetype=stash partnerId=* error_msg_service=* tax_year=2019 capability=* intuit_tid=* capability=* 
| eval error_msg_service = case(match(error_msg_service, "OK"), "Success", 1==1, "Fail") 
| timechart span=1w dc(intuit_tid) by error_msg_service 
| fillnull 
| eval total=Fail+Success, success_rate=round(((Success/total)*100),2) 
| fieldformat success_rate=tostring('success_rate')+"%" 
| fields _time, total, Success, Fail, success_rate 
| eval _time=strftime(_time,"%m-%d-%Y") 
| transpose column_name="Week Starting" header_field=_time 
| regex "Week Starting"!=("^_")
| fields - success_rate

alt text

0 Karma

Re: Transpose & Calculated Field from Eval

Path Finder

I figured it out. It's the fieldformat that's the constraint. I removed it and I achieved what I wanted.

View solution in original post

0 Karma