topic Re: How do you add percentage of total for several columns in a table? in Splunk Search

How do you add percentage of total for several columns in a table?

alessandrocicch — Tue, 30 Oct 2018 14:41:45 GMT

Hi all,

I'm quite new to Splunk and I'm struggling trying to add percentages to a table that I built from two indexes (sorry if the same question has been already asked, but I didn't find any applicable to my case).

The table I have looks like this:

What I'm trying to do now is add, for each column, percentages of total: for example Actual_Sept % = 536 /1640 and 1104 / 1640 and so on for all columns

Hope you can help on this,

thanks anyway

Alessandro

Re: How do you add percentage of total for several columns in a table?

renjith_nair — Tue, 30 Oct 2018 16:29:42 GMT

@alessandrocicchella,

If you could remove addcoltotals from your search, give this a try

"Your search without addcoltotals (or the last row) " |eventstats sum(*) as sum_*
|foreach * [eval <<FIELD>>_%=<<FIELD>>/sum_<<FIELD>>]|fields - sum_*

If this does not work, please provide the search used to find the current count/values under each field, we shall try alternative/better searches.

Re: How do you add percentage of total for several columns in a table?

jlelli — Tue, 30 Oct 2018 16:33:01 GMT

With the eval command is quite simple to do that; something like:

| eval Percentage= round(100 * Count / Total,2)

However I don't understand how you are using the fields in your table; if i understood correctly the "Actual_Sept" field has in it the values of both the dividend and the divisor. Is that correct?

Re: How do you add percentage of total for several columns in a table?

alessandrocicch — Tue, 30 Oct 2018 16:52:00 GMT

Hi Renjith,
it works great 😄

Thank you very much for your fast and effective help