here's the spl query
index="acoe_np_spa_metrics"| search Project="*" AND Volume="*" |bin _time span=1month | stats
count(eval(D_Status="F")) as success_count
count(eval(D_Status="S")) as failure_count | eval TOTAL_COUNT=(success_count + failure_count) | eval STP=(success_count/TOTAL_COUNT)*100 | timechart STP
There's no need to use stats/bin, you can do it all with timechart and post calculations.
index="acoe_np_spa_metrics"
| search Project="*" AND Volume="*"
| timechart span=1mon count(eval(D_Status="F")) as success_count
count(eval(D_Status="S")) as failure_count count as Total
| eval STP=(success_count/Total)*100
| fields - Total
So generate the timechart and include the Total count per month also, then just calculate the success percentage at the end and then remove the Total field if you don't want it.
Note that this assumes Total will be the same as success+failure - if not, then calculate Total afterwards instead.
Thanks it works, but seems I actually had to get the sum of the volume where D_status = F and sum of volume where D_Status = S...
How can I achieve this?
If you want to get the total success/failure counts not split by month then just add an eventstats at the end
| eventstats sum(success_count) as total_success_count sum(failure_count) as total_failure_count
is that what you are after?