I'm doing something wrong here.. . I have the following search
...| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio < 98 | sort SuccessRatio
I'm trying to filter out anything that has a SuccessRatio of greater than 98% but its not working I'm still getting results that have 100% success.
because you appended "%" to the number before filtering, making it a string (not a number). SuccessRatio is not a number, it's a string. eval, filter, sort, and then format it:
... | eval SuccessRatio = round(100*succeeded_count/task_count) | where SuccessRatio < 98 | sort SuccessRatio | eval SuccessRatio = SuccessRatio . "%"
Did you ever get this to work?
Test to see if succeeded_count and task count are actually numbers. Other than that, I cannot see why this would not work
*|eval succeeded_count=99 |eval task_count=1| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio < 98 | sort SuccessRatio
vs
*|eval succeeded_count=20 |eval task_count=1| eval SuccessRatio = (round(((succeeded_count)/(task_count)) * 100)). "%" | search SuccessRatio < 98 | sort SuccessRatio
Seems to work for the above