Using Eval where

[tb5821]

I'm doing something wrong here.. . I have the following search

...| eval SuccessRatio =  (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio < 98 |  sort SuccessRatio

I'm trying to filter out anything that has a SuccessRatio of greater than 98% but its not working I'm still getting results that have 100% success.

[gkanapathy]

because you appended "%" to the number before filtering, making it a string (not a number). SuccessRatio is not a number, it's a string. eval, filter, sort, and then format it:

  ... | eval SuccessRatio = round(100*succeeded_count/task_count) | where SuccessRatio < 98 | sort SuccessRatio | eval SuccessRatio = SuccessRatio . "%"

[davecroto]

Did you ever get this to work?

[davecroto]

Test to see if succeeded_count and task count are actually numbers. Other than that, I cannot see why this would not work

[davecroto]

*|eval succeeded_count=99 |eval task_count=1| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio < 98 | sort SuccessRatio

vs

*|eval succeeded_count=20 |eval task_count=1| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio < 98 | sort SuccessRatio

Seems to work for the above