I'm using the following search to generate the table below:
rex "<status>(?<status>.*?)<"|
search status=Incomplete OR status=Complete OR status=Fail* |
count(status) by cRegion status
I'd like to create a fifth column which calulates the SuccessRate for each cRegion like this:
(Complete-(Failed+Incomplete)) / (Complete + Failed + Incomplete)
I've tried an assortment of different eval and stat and table expressions but cannot figure it out. Any help would be greatly appreciated! I would like to use the chart command.
How about this?
rex "<status>(?<status>.*?)<"
| search status=Incomplete OR status=Complete OR status=Fail*
| chart count(status) by cRegion status
| eval SuccessRate = round((Complete - (Failed + Incomplete)) / (Complete + Failed + Incomplete), 6)
How about this?
rex "<status>(?<status>.*?)<"
| search status=Incomplete OR status=Complete OR status=Fail*
| chart count(status) by cRegion status
| eval SuccessRate = round((Complete - (Failed + Incomplete)) / (Complete + Failed + Incomplete), 6)
Wow, thank you so much!
I didn't know Splunk would know that the Complete/Failed/Incomplete parameters in the eval statement correspond to statuses and to automatically include them in the chart.