https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435618#M124207 <P>can you try </P> <PRE><CODE>index=hocus_pocus OR index=shazam [| inputlookup Server_list.csv | rename DnsName AS host | fields host] | fields host | fields - _raw _time | dedup host | eval "logfound"="1" | eval host=lower(host) | eventstats sum(logfound) as total | eval perc=logfound/total*100 </CODE></PRE> Thu, 08 Aug 2019 15:57:59 GMT mayurr98 2019-08-08T15:57:59Z https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435615#M124204 <P>Hello fellow Splunkers. I made a query that shows the right results. I would like to show these results in percentage.</P> <P>This is my query:</P> <P>index=hocus_pocus OR index=shazam<BR /> [| inputlookup Server_list.csv <BR /> | rename DnsName AS host <BR /> | fields host] <BR /> | fields host <BR /> | fields - _raw _time<BR /> | dedup host <BR /> | eval "logfound"="1" <BR /> | eval host=lower(host) <BR /> | addcoltotals <BR /> | tail 1 <BR /> | fields logfound</P> <P>Thanks guys</P> Wed, 30 Sep 2020 01:39:55 GMT https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435615#M124204 KarnN 2020-09-30T01:39:55Z https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435616#M124205 <P>Please post a table or image showing what the output looks like now, and where you want percentages.</P> Thu, 08 Aug 2019 15:39:45 GMT https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435616#M124205 jpolvino 2019-08-08T15:39:45Z https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435617#M124206 <P>Hi jpolvino, thanks for the response.<BR /> I basically want a percentage of the total. I now get a result of the total of 22 servers in total. 16 has been found. I want this to be displayed in percentage. I will place a image of the total</P> Thu, 08 Aug 2019 15:53:15 GMT https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435617#M124206 KarnN 2019-08-08T15:53:15Z https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435618#M124207 <P>can you try </P> <PRE><CODE>index=hocus_pocus OR index=shazam [| inputlookup Server_list.csv | rename DnsName AS host | fields host] | fields host | fields - _raw _time | dedup host | eval "logfound"="1" | eval host=lower(host) | eventstats sum(logfound) as total | eval perc=logfound/total*100 </CODE></PRE> Thu, 08 Aug 2019 15:57:59 GMT https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435618#M124207 mayurr98 2019-08-08T15:57:59Z https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435619#M124208 <P>Hi mayurr98,</P> <P>Thank you for the support. I tried this query. I get a overview of the hosts but no total percentage of the foundservers <span class="lia-unicode-emoji" title=":disappointed_face:">😞</span></P> Thu, 08 Aug 2019 16:07:31 GMT https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435619#M124208 KarnN 2019-08-08T16:07:31Z https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435620#M124209 <P>Are there any other options?</P> Fri, 16 Aug 2019 09:30:08 GMT https://community.splunk.com/t5/Splunk-Search/Results-in-percentage/m-p/435620#M124209 KarnN 2019-08-16T09:30:08Z