topic Re: How do you get multiple percentage results in one table? in Splunk Search

How do you get multiple percentage results in one table?

stephenmeyers — Fri, 15 Feb 2019 14:57:20 GMT

I would like to report the total number games played per team, and the percentage of wins, losses, and ties by team. Example data:

team=A result=win
team=A result=loss
team=B result=win
team=B result=win
team=B result=tie
team=A result=loss
team=B result=win

Desired Splunk output:

Team    Games Played    Win %    Loss %    Tie %
A       3               33%      66%       0%
B       4               75%      0%        25%

Re: How do you get multiple percentage results in one table?

vnravikumar — Fri, 15 Feb 2019 15:20:25 GMT

Hi @stephenmeyers

Try this, considered column name asTeam,Result in index

your query...| stats count as played, count(eval(Result=="win")) as win,count(eval(Result=="loss")) as loss,count(eval(Result=="tie")) as tie by Team 
| eval loss=round(loss/played*100,2)."%", win=round(win/played*100,2)."%", tie=round(tie/played*100,2)."%" 
| rename played as "Game Played", win as "Win%", loss as "Loss%", tie as "Tie%"