topic Re: Search uniq into array, new search Where uniq array into another search to get percentage in Splunk Search

Search uniq into array, new search Where uniq array into another search to get percentage

jbanhome — Mon, 08 Jun 2020 22:59:34 GMT

Hi,

Can you please point me into right direction or already answered good topic about one Splunk search where I have indexed.

Example data:
Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes

Now I want first to dedup (or get unique vaules into array -> Yo and Bro)
and then get chart results in percentages like
Yo 75% Yes, 25% No
Bro 50% Yes, 50% No.

And probably put in into Chart where X axis will be Yo, Bro, .... and Y axis percentage in 2 colors. 🙂

Thanks.

Re: Search uniq into array, new search Where uniq array into another search to get percentage

jbanhome — Sat, 28 Mar 2020 16:50:02 GMT

Followed: https://answers.splunk.com/answers/438609/calculate-sum-of-multiple-fields-in-different-line.html
This gives me good starting point and I get search to search what I need with good results.

Re: Search uniq into array, new search Where uniq array into another search to get percentage

to4kawa — Sat, 28 Mar 2020 22:56:33 GMT

|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.

If you use stats early ,you can make better query.