Splunk Search

How to add a percentage column to a table

vshakur
Path Finder

I have a query that ends with:

| chart count by  suite_name, status

suite_name consists of many events with a status of either FAIL or PASS.
I get a table with the header: | suite_name | FAIL | PASS |
The table displays the total number of fails and passes for each suite name.
I would like to add a percentage column that would represent for each row (each suite name) the passing rate: (pass*100)/(pass+fail)

How do I do that?

Thanks,
Samuel

Tags (3)
0 Karma
1 Solution

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

View solution in original post

woodcock
Esteemed Legend

You can just use | top suite_name BY status instead or you can add this to the end:

| addtotals row=t col=f
| rename Total AS _total
| foreach * [eval "<<FIELD>>_PCT"=if(isnum('<<FIELD>>'), 100*'<<FIELD>>'/_total, null())]

OR better yet use this last line instead:

| foreach * [eval "<<FIELD>>"=if(isnum('<<FIELD>>'), '<<FIELD>>' . "(" . 100*'<<FIELD>>'/_total . "%)", '<<FIELD>>')]
0 Karma

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

Get Updates on the Splunk Community!

Join Us for Splunk University and Get Your Bootcamp Game On!

If you know, you know! Splunk University is the vibe this summer so register today for bootcamps galore ...

.conf24 | Learning Tracks for Security, Observability, Platform, and Developers!

.conf24 is taking place at The Venetian in Las Vegas from June 11 - 14. Continue reading to learn about the ...

Announcing Scheduled Export GA for Dashboard Studio

We're excited to announce the general availability of Scheduled Export for Dashboard Studio. Starting in ...