How do you divide values in a field?

Question

I have the following search string:

index=other_gomez sourcetype=other_gomez_avail http://myreports.yellowpages.ca/ earliest=-2w-2d latest=-2d | eval Date=if(_time>relative_time(now(),"-1w-2d"),"this_week","last_week") | chart count over pagestatus by Date  | table pagestatus last_week this_week | addcoltotals | eval pagestatus=if(isnull(pagestatus),"TOTAL",pagestatus) | fields pagestatus,last_week,this_week | rename pagestatus as "Page Status" last_week as "Last week" this_week as "This week"

I'm trying to calculate the percentage failed for this week and last week (FAIL/TOTAL). How can I divide values in the same field?

Answer 1

0

You can use appendpipe to calculate the fraction of "FAIL" over "TOTAL" per week from the table and append a new row:

| appendpipe [chart eval(100*sum(eval(if(pagestatus=="FAIL", "Last week", 0)))/sum(eval(if(pagestatus=="TOTAL", "Last week", 0)))) as "Last week" eval(100*sum(eval(if(pagestatus=="FAIL", "This week", 0)))/sum(eval(if(pagestatus=="TOTAL", "This week", 0)))) as "This week" | eval "Page Status" = "Failure percent"]

link

answered 30 Mar '12, 11:30

Stephen Sorkin ♦
8.9k●5●10
accept rate: 52%

appendpipe! I never knew there was such a command and it worked! Thanks so much for your help!!

(02 Apr '12, 08:27) acabrera1

How do you divide values in a field?

Follow this question

Splunk Resources

Related questions