Need some help on some Splunk Search Syntax.
| inputlookup defect__kvs
| search (week_date="") (type="") (sub_type="") (model="") (sub_type=) (model=)
| eval total_polulation=700 (this will be a $token$ in a panel)
| stats count by failure sw_type
| rename count as num_failure
| eval pct_of_total=(num_failure/total_population) | table failure sw_type num_failure pct_of_total
pct_of_total does not produce a value.
I do not want to do appendcols or a subsearch as the Token is to be widely used and it works in other queries as a variable. Total_polulation cannot be derived from the Event Set.
Basically the totals are derived in the following XML
is eval total_polulation copied from your actual query? If so, then your problem is the typo in it.
I just tried what you did with some other data/fields, and it works for me.
Thank for your response. Actually this was not a typo as I was editing the search to remove customer information. I did manage to get it to work but it was strange, for if I place the "|eval a=700" before the stats statement it does not compute, but after it it does. This was the final query.
THIS DOES NOT WORK
| inputlookup defect__kvs
| search (week_date="*") (type="*") (sub_type="*") (model="*") (sub_type="*") (model="*")
| eval total_population=700 | stats count by failure sw_type | rename count as num_failure
| eval pct_of_total=(num_failure/total_population)
| rename count as num_failure | table failure sw_type num_failure pct_of_total
THIS DOES WORK
| inputlookup defect__kvs
| search (week_date="*") (type="*") (sub_type="*") (model="*") (sub_type="*") (model="*")
| stats count by failure sw_type | rename count as num_failure
| eval total_population=700
| eval pct_of_total=(num_failure/total_population)
| rename count as num_failure | table failure sw_type num_failure pct_of_total