Splunk Search

How to add a percentage column to a table

vshakur
Path Finder

I have a query that ends with:

| chart count by  suite_name, status

suite_name consists of many events with a status of either FAIL or PASS.
I get a table with the header: | suite_name | FAIL | PASS |
The table displays the total number of fails and passes for each suite name.
I would like to add a percentage column that would represent for each row (each suite name) the passing rate: (pass*100)/(pass+fail)

How do I do that?

Thanks,
Samuel

Tags (3)
0 Karma
1 Solution

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

View solution in original post

woodcock
Esteemed Legend

You can just use | top suite_name BY status instead or you can add this to the end:

| addtotals row=t col=f
| rename Total AS _total
| foreach * [eval "<<FIELD>>_PCT"=if(isnum('<<FIELD>>'), 100*'<<FIELD>>'/_total, null())]

OR better yet use this last line instead:

| foreach * [eval "<<FIELD>>"=if(isnum('<<FIELD>>'), '<<FIELD>>' . "(" . 100*'<<FIELD>>'/_total . "%)", '<<FIELD>>')]
0 Karma

cmerriman
Super Champion

add in |eval percentPass=round(PASS/(PASS+FAIL)*100,2) at the end of your syntax.

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer at Splunk .conf24 ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...