- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Adding a percentage Failure column to a table fro...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
I have the following search.
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status |rename System as "Application" |sort 0 -FAILURE |addtotals fieldname=Total
This search creates a table with a total column and a column for each status. Each column contains a numerical value which is a count. I would like to add a column that will show the percentage of the 'Total' column that the FAILURE column count is . For example if the Total column for SAP FILO is 100 and the failure column value is 20. I wan to have another column that will have 20%. Please help! Thanks!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, given your clarification, like this:
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status |rename System as "Application" | sort 0 -FAILURE | addtotals fieldname=Total | eval pct=100*FAILURE/Total
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK, given your clarification, like this:
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs | chart count(JOB_NAME) over System by job_status |rename System as "Application" | sort 0 -FAILURE | addtotals fieldname=Total | eval pct=100*FAILURE/Total
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Like this:
index=ko_autosys sourcetype=autosys_applog_scheduler_events host="usatlb98" OR host="usatlb91" System="*" JOB_NAME="*" eventtype=autosys_failure_jobs OR eventtype=autosys_terminated_jobs OR eventtype=autosys_restart_jobs OR eventtype=autosys_success_jobs |chart count(JOB_NAME) over System by job_status |rename System as "Application" | addcoltotals | fillnull value="Total" | eval rowTotal=0 | foreach * [eval rowTotal = rowTotal + if(isnum(<<FIELD>>),<<FIELD>>,0)] | sort 6 - rowTotal | eventstats first(rowTotal) AS allTotal | eval pct = 100*rowTotal/allTotal |sort 0 -FAILURE
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thank you again for helping me.
The table should contain 20 rows with the last row being a sum of the column values. There should be 6 columns with the last column containing a total of the row. I would like to have a column that displays a percentage of the total that is in the FAILURE column. These should be the column separated by a space
Application FAILURE RESTART SUCCESS TERMINATED Total PercentFailure
Introducing the 2024 SplunkTrust!
Introducing the 2024 Splunk MVPs!
Splunk Custom Visualizations App End of Life
