topic Percentages display in Splunk Search

Percentages display

shreyad — Mon, 23 Jul 2018 15:16:49 GMT

If I want to display percentages as well as a count for a table and I want the percentages out of the total count of the table, how do I display that?

|multisearch [search index = blah sourcetype="blah" host=blah | tstats count WHERE index = blah sourcetype="blah" host=blah earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest OR ("NAME"="blah") | eval Coast ="EastCoast"]

Re: Percentages display

CarsonZa — Mon, 23 Jul 2018 17:12:24 GMT

you could use |top otherwise you'll have to do some math.

|stats count(_raw) as total
|stats count(x) by x as foo
|eval perc = ((foo / total)*100) + "%"

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Top

Re: Percentages display

somesoni2 — Mon, 23 Jul 2018 17:36:17 GMT

Try like this

|multisearch [search index = blah sourcetype="blah" host=blah [| tstats count WHERE index = blah sourcetype="blah" host=blah  earliest=@mon 
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] 
 ("NAME"="blah_*") OR ("NAME"="blah") | eval Coast ="EastCoast"] 
[search index = blah sourcetype="blah " host=blah
[| tstats count WHERE index = blah sourcetype="blah " host=blah earliest=@mon 
| eval earliest=if(count=0,"-1mon@mon","@mon") 
| table earliest ] 
("NAME"="blah _*") OR ("NAME"="blah *") | eval Coast ="WestCoast"]| dedup HOST.IP |stats count(blah) as NumberOfIPs by Coast
| eventstats sum(NumberOfIPs) as Total
| eval Percentage=round(NumberOfIPs*100/Total,2) 
| fields - Total

Re: Percentages display

shreyad — Tue, 31 Jul 2018 15:37:26 GMT

Thank you!