https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373543#M109849 <P>Try this:</P> <PRE><CODE>index=main | stats count AS Total, count(age) AS MATCHED BY Name location | eval UNMATCHED = Total - MATCHED | multireport [ stats sum(*) AS * BY location | eval PercentExists = round(100 * MATCHED / Total, 1) + "%" | eval PercentDoesNotExist = round(100 * UNMATCHED / Total, 1) + "%" ] [ eval PercentExists = round(100 * MATCHED / Total, 1) | sort 0 - pctMatched | dedup 5 location | eval Top_5_Unmatched_Names = "Name=" . Name . ", Total=" . Total . ", PercentExists=" . PercentExists . "%" | table Top_5_Unmatched_Names location ] | stats list(*) AS * BY location </CODE></PRE> Wed, 02 May 2018 15:00:12 GMT woodcock 2018-05-02T15:00:12Z https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373542#M109848 <P>I have got multiple events in a log file which contains few key-value pairs and i want to look at only the existence of three key-value pairs (name and location) in all the events.</P> <P>Name="xyz", age="aa" and location="zzz"</P> <P>I want to find the percentage of events where "age" does not exist by location and all the "Name" by location</P> <P>I have following query which gives me the result but not what im expecting.</P> <P>Key "Name" is being in under location where the event "age" does not exist. The column should be blank under location if "age" does not exist.</P> <P>Also I need recent five "Name" in which age does not exist.</P> <P>index=main<BR /> | stats count as Total, count(eval(NOT isnull(age))) as MATCHED count(eval(isnull(age))) as UNMATCHED by location<BR /> | eval pctMatched = round(MATCHED/Total*100, 1)<BR /> | eval pctUnmatched = round(UNMATCHED/Total*100, 1)<BR /> | eval PercentExists = pctMatched + "%"<BR /> | eval PercentDoesNotExist = pctUnmatched + "%"<BR /> | table cluster percentTagged percentUntagged<BR /> | appendcols [ search index=main<BR /> | stats count by location, Name<BR /> | sort -count <BR /> | streamstats count as rank by location | where rank &lt;= 5<BR /> | stats list(Name) as Name, list(count) as count by location<BR /> | fields - location, count<BR /> | table Name ]</P> Tue, 29 Sep 2020 19:20:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373542#M109848 bollam 2020-09-29T19:20:05Z https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373543#M109849 <P>Try this:</P> <PRE><CODE>index=main | stats count AS Total, count(age) AS MATCHED BY Name location | eval UNMATCHED = Total - MATCHED | multireport [ stats sum(*) AS * BY location | eval PercentExists = round(100 * MATCHED / Total, 1) + "%" | eval PercentDoesNotExist = round(100 * UNMATCHED / Total, 1) + "%" ] [ eval PercentExists = round(100 * MATCHED / Total, 1) | sort 0 - pctMatched | dedup 5 location | eval Top_5_Unmatched_Names = "Name=" . Name . ", Total=" . Total . ", PercentExists=" . PercentExists . "%" | table Top_5_Unmatched_Names location ] | stats list(*) AS * BY location </CODE></PRE> Wed, 02 May 2018 15:00:12 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373543#M109849 woodcock 2018-05-02T15:00:12Z https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373544#M109850 <P>I reedited/resubmitted this about 20 times so if it didn't work, make sure you refresh and try the updated answer.</P> Wed, 02 May 2018 15:11:05 GMT https://community.splunk.com/t5/Splunk-Search/how-to-use-append-to-list-out-the-values-respective-to-the/m-p/373544#M109850 woodcock 2018-05-02T15:11:05Z