How to count the number of events by unique value by sourcetype?

[corlettb]

I'm new to Splunk and am not quite sure how to approach this. I have several different automated jobs such as generating checksums, tar and ffmpeg transcodes and they all write job information to log files like this:

job="filename.txt", job_status=incoming
job="filename.txt", job_status=outgoing, job_result=True
job="filename2.txt", job_status=incoming
job="filename2.txt", job_status=outgoing, job_result=False, error-type="file-read-error"

What I am interested in is finding out is how many of each job ends in failure grouped by each automated process, which are different source types to Splunk, all part of the same index

So I'm looking to create a table like this:

sourcetype, # of jobs, # of success, # of fail, % of jobs that failed
checksum, 1000, 900, 100, %10
tar, 100,85,15,%15
ffmpeg, etc...

I can run this search:

index=automatedprocesses job_status=outgoing | stats count by sourcetype

and get the first two columns of my table.

I can run:

index=automatedprocesses job_status=outgoing job_result=True | stats count by sourcetype

and

index=automatedprocesses job_status=outgoing job_result=False | stats count by sourcetype

to get the next two columns, but I can't figure out how to run them all together (Or more efficiently, run 1 search and count the values based on those results) and then get the % column at the end.

I've done this

index=automatedprocesses job_status=outgoing | stats values(job_result) AS result by sourcetype

but it just tells me that job_result has True and False responses...

Any advice is appreciated, thanks.

[somesoni2 · Accepted solution]

Do like this

 index=automatedprocesses job_status=outgoing | chart count over sourcetype by job_result
| rename True as Success False as Failure | addtotals | eval Perc_Fail=round(Failure*100/Total,2)