topic How to use eval to find percentage for field values? in Splunk Search

How to use eval to find percentage for field values?

jwalzerpitt — Wed, 08 Jan 2020 17:01:53 GMT

I have values for a field named action, block, passed, and alerted. How would I go about creating a search to looks for the percentage of blocked to passed/alerted events?

I have the basic search of
index=foo
| stats count by src, action
| stats list(action) as Action, list(count) as count, sum(count) as Total by src

and was thinking eval could be used in some way

Thx

Re: How to use eval to find percentage for field values?

aberkow — Wed, 08 Jan 2020 18:12:57 GMT

You're definitely on the right track - I like doing something like this for readability, as you clearly create a variable for pass and fail, and set it to a bool. Then, you can just sum them by whatever you want (I did src in this case), then do a simple divide eval command to get the percent.

index=foo
| stats count by src, action
|eval pass=if(action="pass", 1, 0)
|eval fail=if(action="fail", 1, 0)
|stats sum(pass) as numPass, sum(fail) as numFail by src
|eval failPerc=numFail/(numFail + numPass) * 100

Hope this helps!

Re: How to use eval to find percentage for field values?

jwalzerpitt — Fri, 10 Jan 2020 14:32:21 GMT

Thx for the search. The issue that I'm having with the search you suggested is that the count of each action is reduced to a sum of the count which is just '1' and not the total count,. For example, I have IPs that are into the hundreds for allows, yet when I run the search they're reduced to one pass/fail.

I changed the last line to | stats count(pass) as numPass, count(fail) as numFail by src and the count was more than one, but way less then the true count. It's like the eval isn't being applied to every event.

Thx

Re: How to use eval to find percentage for field values?

to4kawa — Fri, 10 Jan 2020 19:43:44 GMT

Sample query:

| makeresults count=1000
| eval src="A.A.A.A#B.B.B.B#C.C.C.C#D.D.D.D"
| eval action="pass#fail"
| eval src=mvindex(split(src,"#"),random() % 3)
| eval action=mvindex(split(action,"#"),random() % 2)
| chart limit=0 count by src action
| eval failPerc=round(fail / ( fail + pass ) * 100,2)

recommend:

index=foo action=fail OR action=pass
| chart limit=0 useother=f usenull=f count by src action
| eval failPerc=round(fail / ( fail + pass ) * 100,2)