topic Re: Can you help me with a stats count that returns a percentage? in Splunk Search

Can you help me with a stats count that returns a percentage?

jip31 — Wed, 27 Feb 2019 08:01:50 GMT

Hi,

I use the search below in order to count event number.

I want to do the same calculation, but in percent

eventtype="Start" AND (NOT host=E* AND NOT host=I*)
| eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit') 
| eval File_Name=coalesce(Nom_du_fichier,File_Name,Dateiname,Nombre_de_archivo)  
| stats dc(Degradation_Time) as Total by File_Name 
| sort -Total limit=10

Could you help me please

Re: Can you help me with a stats count that returns a percentage?

cvssravan — Tue, 29 Sep 2020 23:26:52 GMT

Hi, you can try top command(by default it will give 10 results, so I haven't used limit):

eventtype="Start" AND (NOT host=E* AND NOT host=I*)
2. | eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit')
3. | eval File_Name=coalesce(Nom_du_fichier,File_Name,Dateiname,Nombre_de_archivo)

4. | top Degradation_Time as Total by File_Name

Re: Can you help me with a stats count that returns a percentage?

cvssravan — Tue, 29 Sep 2020 23:26:55 GMT

If you want to consider distinct count as well, try this:

Re: Can you help me with a stats count that returns a percentage?

jip31 — Wed, 27 Feb 2019 12:52:16 GMT

it s not want i want
In my query I count the number of degradation time by file name
I want the same thing in percent.....

Re: Can you help me with a stats count that returns a percentage?

astatrial — Tue, 29 Sep 2020 23:30:32 GMT

What do you mean by "the same calculation in percent" ?
What is your total ? The count of distinct Degradation_Time from all files ? The count of Degradation_Time values from the total number of Degradation_Time ?

Regards ,

Re: Can you help me with a stats count that returns a percentage?

jip31 — Tue, 29 Sep 2020 23:27:06 GMT

My result is the total of degradation time by File_Name. The total is a integer number
Now I want the same in percent
I have done this but I have not the exactly the same result
The first field name in the integer panel is in second position in the percent panel :

Re: Can you help me with a stats count that returns a percentage?

cvssravan — Tue, 29 Sep 2020 23:27:25 GMT

Assuming that you are looking for sum(Degradation_Time) by file and then percentage, not count. See my answer below:

eventtype="Start" AND (NOT host=E* AND NOT host=I*)
| eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit')
| eval File_Name=coalesce(Nom_du_fichier,File_Name,Dateiname,Nombre_de_archivo)
| stats sum(Degradation_Time) as Degradation_Time_By_File by File_Name
| appendcols
[search eventtype="Start" AND (NOT host=E* AND NOT host=I*)
| eval Degradation_Time=coalesce('Durée de la dégradation','Degradation Time','Tiempo de degradación','Beeinträchtigungszeit')
| stats sum(Degradation_Time) as Total_Degradation_Time]
| filldown Total_Degradation_Time
| eval Percent_Degradation_Time_By_File =(Degradation_Time_By_File*100)/Total_Degradation_Time

Hope it works

Re: Can you help me with a stats count that returns a percentage?

jip31 — Thu, 28 Feb 2019 08:41:31 GMT

it was just an issue in my stats count I close the topic