How to get a percentage out of 2 queries?

[kvanwagoner]

I've got 2 search queries that are working for me (Thanks to @harshpatel)

Query #1 returns the average # of successes over the last 7 Days.

"A PUT was made to OpenAAA API - Status: OK" | spath AppID | search AppID=200296 Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)

Query #2 returns the average # of failures over the last 7 Days.

"A PUT was made to OpenAAA API - Status: 1" | spath AppID | search AppID=200296 Environment=prod | timechart count by Environment | bin span=7d _time | stats avg(prod)

How can I find out the percentage of failures based on these 2 queries? AVG # of Failures divided by AVG # of Successes

Example. 100 success and 50 failures .... Percentage of Failures would be 50%)

Any help will be greatly appreciated!

Thanks

[Vijeta · Accepted solution]

@kvanwagoner Try this -

 "A PUT was made to OpenAAA API - Status: *" | rex "Status: (?<status>\w+)" | spath AppID 
 | search AppID=200296 Environment=prod | timechart count(eval(status="OK")) as success, count(eval(status="1")) as failures| bin span=7d _time 
 | stats avg(success) as S, avg(failures) as F| eval pct=( F * 100 ) / S

[kvanwagoner]

Thanks @Vijeta . That works great!

[richgalloway]

Try combining the two queries.

"A PUT was made to OpenAAA API - Status: *" | rex "Status: (?<status>\w+)" | spath AppID 
| search AppID=200296 Environment=prod | timechart count by Environment | bin span=7d _time 
| stats count, count(eval(status="OK")) as successes, count(eval(status=1)) as failures | eval pct=(failures*100)/successes

[kvanwagoner]

Thanks @richgalloway
This is returning
count=08
failures=0

successes=0
The two separate queries return 359 success and 7 failures. Which would be around 1.9%

Any ideas?

[kvanwagoner]

@harshpatel any ideas on this?