https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385865#M1220 <P>This should give you the desired results:</P> <PRE><CODE>host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason) as reasons count(eval(disconnect_reason=="Dialog has failed")) as failed_diag count(*) as total by remote_alias | eval perc_failed=(failed_diag/total*100) </CODE></PRE> <P>If you want to hide one or more of the calculated fields you can always exclude them with <CODE>fields -fieldname</CODE></P> Tue, 12 Feb 2019 14:14:34 GMT DMohn 2019-02-12T14:14:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385863#M1218 <P>I have some call logs that I want to sort. </P> <P>I have fields for remote_alias and disconnect_reason. There are many different disconnect reasons, but I want to see how many calls have disconnect_reason="<STRONG>Dialog has failed</STRONG>" as compared to the total, and then sort it by remote_alias; then, we could see how many times a user has had this reason code compared to the number of times they have called.</P> <PRE><CODE>host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason) by remote_alias </CODE></PRE> <P>If i run this command, then I'll see results in a list like this:</P> <P><IMG src="https://community.splunk.com/storage/temp/267625-dcreasons.jpg" alt="alt text" /></P> <P>michal here has 9 events, where 1 of them is "dialog has failed". Is there any way to get this all in two columns? One for the total and the other for number of "dialog has failed" occurrences pr remote alias ?</P> Tue, 29 Sep 2020 23:15:39 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385863#M1218 tsushi 2020-09-29T23:15:39Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385864#M1219 <P>Hi,</P> <P>Try this</P> <PRE><CODE>host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason), count as Total_Count, sum(eval(if(disconnect_reason="dialog has failed",1,0))) as sum_dialog_failed by remote_alias </CODE></PRE> Tue, 12 Feb 2019 14:10:30 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385864#M1219 harsmarvania57 2019-02-12T14:10:30Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385865#M1220 <P>This should give you the desired results:</P> <PRE><CODE>host="Pexip Participant History" local_alias="*video.difi.no*" protocol="MSSIP" | stats list(disconnect_reason) as reasons count(eval(disconnect_reason=="Dialog has failed")) as failed_diag count(*) as total by remote_alias | eval perc_failed=(failed_diag/total*100) </CODE></PRE> <P>If you want to hide one or more of the calculated fields you can always exclude them with <CODE>fields -fieldname</CODE></P> Tue, 12 Feb 2019 14:14:34 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385865#M1220 DMohn 2019-02-12T14:14:34Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385866#M1221 <P>Awe heck, that was fast. And it works perfectly as well. Thank you !</P> Tue, 12 Feb 2019 14:16:49 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385866#M1221 tsushi 2019-02-12T14:16:49Z https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385867#M1222 <P>Welcome <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span> </P> Tue, 12 Feb 2019 14:19:56 GMT https://community.splunk.com/t5/Splunk-Enterprise/How-do-you-count-the-number-of-occurrences-and-compare-with-the/m-p/385867#M1222 harsmarvania57 2019-02-12T14:19:56Z