percentage of field

[tej8]

I have two fields body.response.successcount and body.response.failurecount .How to write query for success count % & failure Count % individually?

[burwell]

Something like this?

<your search>
|  eval success_percent = (body.response.successcount*100)/total
|  eval failure_percent = (body.response.failurecount*100)/total