% failures for same index

[VS0909]

Need help with a Splunk query  to display % failures for each day during the time range selected, for same index but different search term

% failures = A1/A2 *100

A1= Total number of events returned by the below query:

index="abc"  "searchTermForA1"

A2= Total number of events returned by the below query:

index="abc"  "searchTermForA2"

Expected Output:

-------Date-------|--------A1-------------|------A2----------|-----% failures-------

Separate rows in the result set for date 1-Jul, 2-Jul, 3-Jul, 4-Jul, 5-Jul, 6-Jul and 7-Jul, for time range selected as 1Jul to 7-Jul.

Please help with the query.

Thanks!

[venkatasri]

Hi @VS0909 

Can you try this,

index="abc" "searchTermForA1" OR "searchTermForA2" 
| eval e_t=case(match(_raw, "searchTermForA1"), "A", match(_raw, "searchTermForA2"), "B") 
| bin span=1d _time 
| stats count(eval(e_t = "A")) as A1, count(eval(e_t = "B")) as A2 by _time 
| eval fail_perc=(A1/A2) * 100 
| table _time A1 A2 fail_perc

---

An upvote would be appreciated and Accept solution if this reply helps!