https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372393#M109528 <P>Can you try this please:</P> <PRE><CODE>&lt;YourBaseSearch&gt;| stats count by name | eventstats sum(count) as tot | eval pers=round(100*count/tot,2).% </CODE></PRE> <P>For avg you want calcul the avg by what?</P> Tue, 01 May 2018 08:47:28 GMT TISKAR 2018-05-01T08:47:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372391#M109526 <P>Good Day splunkers. I have a query where i want to calculate the number of times a name came on the field, the average times the name was used and the percentage of the name in the field. (The below is truncated for understanding)</P> <PRE><CODE>splunkd 12,786 1.1% Apache#1 12,094 1.041% splunk-perfmon 11,788 1.015% java#3 11,684 1.006% rotatelogs 11,452 0.986% svchost#4 11,409 0.982% perl 11,078 0.954% emagent 10,821 0.931% Tomcat7 10,309 0.887% splunk-regmon 10,274 0.884% </CODE></PRE> <P>If the field values were numeric I could have counted and summed and created the avg. but when the field value names like above how do I go forward? I have done something similar once with eval but I can't seem to figure this out.<BR /> Thanks</P> Tue, 01 May 2018 06:30:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372391#M109526 ranjitbrhm1 2018-05-01T06:30:09Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372392#M109527 <P>Try something like this:</P> <PRE><CODE>...your search here... | eventstats count as namecount by name | eventstats count as totalcount | eval percentage=(namecount/totalcount)*100 | fieldformat percentage=percentage."%" </CODE></PRE> Tue, 01 May 2018 08:03:25 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372392#M109527 FrankVl 2018-05-01T08:03:25Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372393#M109528 <P>Can you try this please:</P> <PRE><CODE>&lt;YourBaseSearch&gt;| stats count by name | eventstats sum(count) as tot | eval pers=round(100*count/tot,2).% </CODE></PRE> <P>For avg you want calcul the avg by what?</P> Tue, 01 May 2018 08:47:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372393#M109528 TISKAR 2018-05-01T08:47:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372394#M109529 <P>How to find out count and average of a text based field for every 1 minute of time span</P> Thu, 28 Jun 2018 07:34:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-average-and-percentage-for-fields-with-only/m-p/372394#M109529 akarivaratharaj 2018-06-28T07:34:50Z