Comparing two searches and displaying the result as a percentage

[epreece]

Hi all,

I have two searches that provide useful data points. One shows failures, one successes. I would like to further enhance this data by showing the failures as a percentage of total and successful transactions. I have looked a couple examples and haven't been able to formulate a working query. Below is what I think should work (based on this example) however I get an error: Error in 'search' command: Unable to parse the search: unbalanced parentheses. My parentheses are matching. I'd be grateful for a little help.

Thanks!

(index="x" source="foo" | transaction RequestId keepevicted=true | search success) 

OR 

(index="x" source="foo" | transaction RequestId keepevicted=true | search NOT success)

| eval(index="x" source="foo" |transaction RequestId keepevicted=true | search success) as success,

| eval(index="x" source="foo" |transaction RequestId keepevicted=true | search NOT success) as failure

| eval pct=100 * failure / success

[kristian_kolb · Accepted solution]

Well, I don't think you can use parentheses across piped commands. Using the ever popular and rather simple example of authentication logs, which could look like;

SUCCESS: 2012-05-14 13:23:33 action=login status=success userid=bob
FAILURE: 2012-05-14 14:54:21 action=login status=failure userid=sally

The search would then be something like;

sourcetype=my_auth action=login 
| stats c AS TOTAL c(eval(status="success")) AS OK c(eval(status="failure")) AS BAD 
| eval BAD_PERC = round((BAD / TOTAL *100),2)

Hope this helps,

Kristian

[epreece]

Thanks! This helped a bunch. Much simpler too and I love simpler.