Splunk Search

Why is fieldformat not working if I don't include a certain value in the table?

danoconnl
Explorer

here is my search, I'm trying to create a report that shows the error count, error percentage, and total transaction count...

| dedup TransactionID | stats count As ErrorCount by TransactionName  | appendcols [search Message="Calling ProcessRequest" | stats count as TotalTransactionCount by TransactionName ]|eval ErrorPerc= if (isnull(ErrorCount), 0, ErrorCount/TotalTransactionCount) | fieldformat ErrorPercentage = tostring(round(ErrorPerc,6)*100)."%" | Table TransactionName  ErrorPercentage ErrorCount ErrorPerc TotalTransactionCount | fillnull value=0 | sort -ErrorCount

If I don't include ErrorPerc in the table, ErrorPercentage shows up as null. I really don't want ErrorPerc in there since it's less readable and a duplicate of ErrorPercentage

Dan

0 Karma
1 Solution

sundareshr
Legend

Try this

| dedup TransactionID | stats count As ErrorCount by TransactionName | appendcols [search Message="Calling ProcessRequest" | stats count as TotalTransactionCount by TransactionName ]|eval ErrorPercentage = if (isnull(ErrorCount), 0, ErrorCount/TotalTransactionCount) | fieldformat ErrorPercentage=tostring(round(ErrorPercentage,6)*100)."%" | Table TransactionName ErrorPercentage ErrorCount TotalTransactionCount | fillnull value=0 | sort -ErrorCount

View solution in original post

0 Karma

sundareshr
Legend

Try this

| dedup TransactionID | stats count As ErrorCount by TransactionName | appendcols [search Message="Calling ProcessRequest" | stats count as TotalTransactionCount by TransactionName ]|eval ErrorPercentage = if (isnull(ErrorCount), 0, ErrorCount/TotalTransactionCount) | fieldformat ErrorPercentage=tostring(round(ErrorPercentage,6)*100)."%" | Table TransactionName ErrorPercentage ErrorCount TotalTransactionCount | fillnull value=0 | sort -ErrorCount
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...