I have two fields body.response.successcount and body.response.failurecount .How to write query for success count % & failure Count % individually?
Something like this?
<your search> | eval success_percent = (body.response.successcount*100)/total | eval failure_percent = (body.response.failurecount*100)/total
