Working out the percentage from two fields

[joe06031990]

Hi,

I am trying to calculate the percentage of two fields however the Perc filed is not being anything back:

Index=test sourcetype=Iis

|table response_time

|eval ResponseTime=response_time/1000

|eval isOver3s=if(ResponseTime>3,1,0)

|eval Perc=round((isOver3s/Event)*100,2)

|eventstats count as Event| stats Values(Event),sum(isOver3s)

|table Event, isOver3s, Perc

Any advice would be greatly appreciated.

thanks,

Joe 

[ITWhisperer · Accepted solution]

Eventstats to count the events needs to be before the eval that uses it.

Index=test sourcetype=Iis
|table response_time
|eval ResponseTime=response_time/1000
|eval isOver3s=if(ResponseTime>3,1,0)
|eventstats count as Event
|eval Perc=round((isOver3s/Event)*100,2)
|stats Values(Event),sum(isOver3s)
|table Event, isOver3s, Perc

[joe06031990]

Hi,

I have tried this and works for the percentage however removes the events for isover3seconds.

Any thoughts?

[ITWhisperer]

|stats Values(Event),sum(isOver3s),sum(Perc)