Hi, can anybody help me please?
I have _json indexed events in Splunk.
19.08.21 08:26:27,746
{ [-]
name: S8.ManuelFail
value: false
}
19.08.21 08:26:25,746
{ [-]
name: S8.Pruefprogramm_PG
value: S3_450
}
19.08.21 08:26:27,746
{ [-]
name: S8.ManuelFail
value: true
}
19.08.21 08:27:25,746
{ [-]
name: S8.Pruefprogramm_PG
value: S3_450
}
19.08.21 08:28:25,746
{ [-]
name: S8.Pruefprogramm_PG
value: S3_600
}
19.08.21 08:29:25,746
{ [-]
name: S8.Pruefprogramm_PG
value: S3_600
}
In the dashboard I choose specific time interval with the time pick up element. E.g. last 24 hours. I would like to have % number for each name: S8.Pruefprogramm_PG and its value, where name: S8.ManuelFail has value: true. It means % all name: S8.ManuelFail
value: true against all name: S8.ManuelFail
value: true/false. It is even possible? E.g. in this case I would like to have a table output:
S8.Pruefprogramm_PG S8.ManuelFail [%]
S3_450 50
