https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437118#M124509 <P>@andrehl, which version of Splunk are you on? Also what is the visualization to depict above output? Is it table or something else?</P> <P>If you are on <CODE>Splunk 6.5 or higher</CODE> you can use Table format option to add Unit as <CODE>%</CODE> rather than adding <CODE>%</CODE> in the eval SPL command. This way your data remains numeric and still displays % in the column.</P> <P>Refer to Splunk Documentation: <A href="https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Number_format_rules">https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Number_format_rules</A></P> Wed, 18 Jul 2018 03:58:05 GMT niketn 2018-07-18T03:58:05Z https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437115#M124506 <P>index="stage"<BR /> |stats dc(customers_name) as "Distinct Customer" by sku_name sku_number<BR /> |rename sku_name as Product sku_number as ID<BR /> |eval Rate=""Distinct Customer" / count(customers_name)"."%"</P> <P>Hi guys,<BR /> I'm trying to calculate the percentage of the customer involved with respect to the grand total number of customers but I cant seem to use count under eval. Any help?</P> <P>Thank you!</P> Tue, 29 Sep 2020 20:26:07 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437115#M124506 andrehl 2020-09-29T20:26:07Z https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437116#M124507 <P><CODE>count</CODE> is a <CODE>stats</CODE> function, not an <CODE>eval</CODE> function. You need to calculate count(customers_name) in a separate command.</P> <PRE><CODE>index="stage" | eventstats count(customers_name) as customerCount dc(customers_name) as "Distinct Customer" by sku_name sku_number |rename sku_name as Product sku_number as ID |eval Rate=('Distinct Customer' / customerCount)."%" </CODE></PRE> Fri, 13 Jul 2018 12:27:57 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437116#M124507 richgalloway 2018-07-13T12:27:57Z https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437117#M124508 <P>Is it still possible to sort if we have characters under eval command?</P> Wed, 18 Jul 2018 02:34:45 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437117#M124508 andrehl 2018-07-18T02:34:45Z https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437118#M124509 <P>@andrehl, which version of Splunk are you on? Also what is the visualization to depict above output? Is it table or something else?</P> <P>If you are on <CODE>Splunk 6.5 or higher</CODE> you can use Table format option to add Unit as <CODE>%</CODE> rather than adding <CODE>%</CODE> in the eval SPL command. This way your data remains numeric and still displays % in the column.</P> <P>Refer to Splunk Documentation: <A href="https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Number_format_rules">https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Number_format_rules</A></P> Wed, 18 Jul 2018 03:58:05 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-based-on-Grand-Total/m-p/437118#M124509 niketn 2018-07-18T03:58:05Z