How do I edit my search to create a table or chart of percentages calculated from my data?

[kahlerb]

I have a log that looks like this

{  
    api: my_api, message:  Events Publish Status 
    event_failed_count:  0 
    event_success_count:  2 
    time:  11-11-2015 01:34:30.511 +0000
  }

What I would like, is to be able to create a chart or even a table, that will show the % of failures and successes. Because these are all part of the same log, I am having trouble.

I've calculated the percentages I am interested in with this search string:

message="Events Publish Status"|eval totalCount = event_success_count + event_failed_count |eval failed=(event_failed_count/totalCount)*100 |eval success=(event_success_count/totalCount)*100

However, I am not sure how to properly display these values. Is there a better way to go about this ? I would prefer to show these on a pie chart, however even just a simple table would suffice.

[frobinson_splun]

Hi @kahlerb,
To build a pie chart, search results should be formatted in a two-column, single series table. The first column would be the labels for the various slices of a pie chart, and the second column would be the values for each of those labels.

In this case, it sounds like your labels would be "success" and "failure". The values would be the count of successes and the count of failures.

See the documentation and examples here:
http://docs.splunk.com/Documentation/Splunk/6.3.1/Viz/Datastructurerequirementsforvisualizations#Pie...

The challenge here seems to be to work with the two "...count" keys/values in your data. As a start, this previous Answers post seems to be related (in particular, take a look at the second search example in this post):
https://answers.splunk.com/answers/174564/how-to-use-two-different-fields-to-create-a-pie-ch.html

I hope this helps! Let me know if you need other suggestions.

All best,
@frobinson_splunk