topic Is there a way to divide the addcoltotals from each case statement in my search? in Splunk Search

Is there a way to divide the addcoltotals from each case statement in my search?

jhayIV — Thu, 29 Jun 2017 16:32:16 GMT

Is there a way to divide the addcoltotals from each case statement in the following :

eval daysclass=case(
NoOfDays<=14,"0-14 DAYS ",
NoOfDays>15 AND NoOfDays<=28,"14-28 DAYS ",
NoOfDays>29 AND NoOfDays<=42,"28-42 DAYS ",
NoOfDays>43 AND NoOfDays<=56,"42-56 DAYS",
NoOfDays>57, "56 DAYS OR MORE "
,1=1,"NULL")|search daysclass!=NULL|stats count(Name) AS "COUNT" by daysclass| ADDCOLTOTALS

Re: Is there a way to divide the addcoltotals from each case statement in my search?

cmerriman — Thu, 29 Jun 2017 17:16:05 GMT

if i get what you're doing, i think this might work:

eval daysclass=case(
 NoOfDays<=14,"0-14 DAYS ",
 NoOfDays>15 AND NoOfDays<=28,"14-28 DAYS ",
 NoOfDays>29 AND NoOfDays<=42,"28-42 DAYS ",
 NoOfDays>43 AND NoOfDays<=56,"42-56 DAYS",
 NoOfDays>57, "56 DAYS OR MORE "
 ,1=1,"NULL")|search daysclass!=NULL|stats count(Name) AS "COUNT" by daysclass|eventstats sum(COUNT) as total|eval divide=COUNT/total