# Doing Math over count of events
**URL:** https://discuss.elastic.co/t/doing-math-over-count-of-events/97278
**Category:** Kibana
**Created:** [August 16, 2017, 2:28pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278 "2017-08-16T14:28:23Z")
**Posts on this page:** 20
**Page:** 1
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 16, 2017, 2:28pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/1 "2017-08-16T14:28:23Z")
Hi,
I have some tomcat app logs in which i am parsing the TransactionName and TransactionStatus fields. My end goal is to create a single value visualisation which shows the percentage of successful transactions over total.
My TransactionStatus field is non-numeric.
for reference Splunk query is like this 🙂
index=app sourcetype=tomcat\_app\_log KpiMetric="CLQ" TransactionName="SearchApplications" | stats count(eval(TransactionStatus = "Success")) as SUCCESS count(eval(TransactionStatus = "Failure")) as FAILURE | eval SuccessRate= Round(SUCCESS/(SUCCESS + FAILURE)\*100 , 2) | fields SuccessRate
I am not sure where this calculation can be done.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 1:51pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/2 "2017-08-17T13:51:58Z")
Here's one option if you're on a recent version of Kibana that has the `Visual Builder` visualization type. I know it's in 5.4.0 and later.
1. go to the `Panel Options` tab and set your index pattern (here I'm using `metricbeat-*`);
1. back on the `Data` tab select `Filter Ratio`
1. I picked `metricset.name:process` as my numerator, but yours would be something like `transactionStatus:Success`
1. The Gauge tab shows a single value and there some options to format as a percent, change the color based on value, etc.
1. **But the gauge is showing the value of the last interval. Not the average over your whole timespan.** So you might want to change the interval from the default `auto` to something that puts everything in your timespan into one bucket. **WARNING:** You should turn off the `Auto Apply` when changing the interval or you'll have errors (there's a bug on it).
2. Lastly, there's also a Markdown tab that lets you put the value with other text. And when you save this visualization it seems that it saves whatever panel you're on. So you can add it to a dashboard.
Regards,
Lee
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 2:46pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/3 "2017-08-17T14:46:57Z")
> [@LeeDr](#):
>
> transactionStatus:Success
Thanks Lee for the nice explanation, but for me it doesnt work. In my case the TransationStatus field is text based and i want to calculate what was the percentage of Successful transaction out of total.
SuccessRate= Round(SUCCESS/(SUCCESS + FAILURE)\*100 , 2)
The method you mentioned doesnt work for me. It is always showing 0.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 3:00pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/4 "2017-08-17T15:00:57Z")
If you just go to Discover, and look at your total `Hits` count in the upper left corner,
then in the query bar put `transactionStatus:success` does that filter your docs down to only the "Success" ones you're looking for?
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 3:06pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/5 "2017-08-17T15:06:35Z")
Yes it gives me the number of documents that have TransactionStatus:"Success" , but as i said my end goal is to get the value of
SuccessRate= Round(SUCCESS/(SUCCESS + FAILURE)\*100 , 2)
where SUCCESS - number of events which have TransactionStatus:"Success" and FAILURE - events which have TransactionStatus:"Failure"
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 4:58pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/6 "2017-08-17T16:58:28Z")
Do all your docs have either success or failure? If so, then the visual builder screen I showed should work because it's doing `transactionStatus:success/*`
In this case `*` means all docs, which is both success and failure.
If some of your docs don't have either success or failure, then we'll need to use something other than `*` for the denominator.
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 5:12pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/7 "2017-08-17T17:12:10Z")
Not all of them have TransactionStatus:Success or TransactionStatus:Failure, some of the documents have that field as blank. But my main intent is to count all the documents with either Success or Failure and calculate the percentage for Success.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 6:18pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/8 "2017-08-17T18:18:05Z")
OK, so in that case the Denominator should be the total where your transactionStatus is either success or failure. In
Elasticsearch queries, listing 2 search terms implies `OR` so in this screenshot I've listed 2 search terms in the denominator and one in the numerator field. This is giving me
`metricseat.name:process/(metricset.name:process + metricset.name:filesystem)`
(you don't have to multiply by 100 because there is already a percent formatting option)
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 6:32pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/9 "2017-08-17T18:32:57Z")
I actually did as per your instructions and for few seconds it was showing some percentage value, then suddenly it changed back to 0%.
Here is my screenshot.
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 6:44pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/10 "2017-08-17T18:44:59Z")
I am not sure if this is a bug, i see % when i click on the Metric visualisation and see some numbers when i see the time series.
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 6:45pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/11 "2017-08-17T18:45:29Z")
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 6:54pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/12 "2017-08-17T18:54:33Z")
So i just calculated manually,
Total documents : 105
Documents containing TransactionStatus:Success : 98
So the percentage comes out to be 93.33 . For few seconds i saw that number on the Gauge but when i saved the visualisation, it changed it back to 0%.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 7:15pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/13 "2017-08-17T19:15:08Z")
Did your timepicker change to something outside the range of your data? When I saved mine it still looked correct.
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 8:33pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/14 "2017-08-17T20:33:32Z")
So now the Guage says it is 100% , but the Markdown says 0%, is it possible to reflect that to true value as well?
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 8:49pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/15 "2017-08-17T20:49:04Z")
Again,
i changed the time picker to just reflect documents for last 24 hours, the discovery tab is showing the total number of documents is 88 and documents which have TransactionStatus:Success is 77, so the percentage should be 90.5 but it is showing 100 % , its strange.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 17, 2017, 9:36pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/16 "2017-08-17T21:36:57Z")
What is your interval set to? There may be some issues at the boundaries of the timespan if the interval is about the same or larger.
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 9:46pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/17 "2017-08-17T21:46:36Z")
What do you mean by time interval, the interval set in the visualisation builder?
The below screenshot is for last 15 minutes, it is showing 4 transactions out of which 3 are successful. But the Visualisation shows 0 again. ☹
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 17, 2017, 9:46pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/18 "2017-08-17T21:46:44Z")
---
### Author:  [@shroh](https://discuss.elastic.co/u/shroh)
#### Post date: [August 18, 2017, 4:06pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/19 "2017-08-18T16:06:29Z")
Hi Lee,
can i get any help on this one? I am stuck at this point.
---
### Author:  [@LeeDr](https://discuss.elastic.co/u/LeeDr)
#### Post date: [August 18, 2017, 4:38pm UTC](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278/20 "2017-08-18T16:38:23Z")
Thanks for your patience. I'm learning more about Visual Builder as I go here...
If you have your first aggregation which is a `Filter Ratio` which is calculating `success/(success or failure)`.
That ratio probably changes over time, and your gauge or markdown is showing the last value. But it sounds like you want a metric that shows the percentage over the entire timespan, which might be `Last 15 minutes` or `Last 30 days`.
So you can add `Overall Average` aggregation to do that. First click the `+` sign on your existing aggregation, and then select `Overall Average` under the `Sibling Pipeline Aggregations`.
The `Metric` field to the right, should list your `Filter Ratio` aggregation from above (mine is different in this screenshot);
So now you shouldn't have to worry about the `Interval` and it should just be set to `Auto`.
Let me know how that works.
[Next page](https://discuss.elastic.co/t/doing-math-over-count-of-events/97278.md?page=2)