SPLUNK enterprise i am trying to calculate results where if > 4% of failure is anomaly?

Question

SPLUNK enterprise i am trying to calculate results where > 4% of failure is anomaly. is formula correct? to set anomaly ?(failcount and total count fields are numeric)

| inputlookup sample.csv | eval isananomaly = if('Failcount' / 'Totalcount' * 100 > 4 , 1 , 0)

Answer 1

The logic appears correct, but why multiply by 100?

Save yourself a step:

| inputlookup sample.csv 
| eval isananomaly = if((Failcount / Totalcount) > .04 , 1 , 0)

Answer 2

this is correct logic

| inputlookup sample.csv | eval isananomaly = if((Failcount * 100 / Totalcount) > 4 , 1 , 0)