https://community.splunk.com/t5/Splunk-Search/finding-percentage/m-p/520906#M146740 <P>Here is one way to combine the two searches.</P><LI-CODE lang="markup">index=main | eval update=if(searchmatch("update*"), Host_Name, NULL) | stats dc(update) as updated, dc(Host_Name) as total | fillnull value=0 updated | eval pct=round((updated*100)/total,2)</LI-CODE> Tue, 22 Sep 2020 18:03:38 GMT richgalloway 2020-09-22T18:03:38Z https://community.splunk.com/t5/Splunk-Search/finding-percentage/m-p/520853#M146726 <P>Good Day all,&nbsp;</P><P>I would like to find the percentage of devices that has updated. The way I would like to do this is to first search index=main | stats dc(Host_Name). This would give me the total number of host names that are sending data to splunk. Out of that I would like to find out what percentage of those is updated. I can search index=main update* | stats dc(Host_Name) and it will give the number of devices that have updated. But how will I find the percentage of devices that have updated? Normally it would be (devices updated/total devices)*100. For this search how do we craft the search?</P><P>Thanks</P><P>&nbsp;</P> Tue, 22 Sep 2020 13:11:19 GMT https://community.splunk.com/t5/Splunk-Search/finding-percentage/m-p/520853#M146726 rabrahaham 2020-09-22T13:11:19Z https://community.splunk.com/t5/Splunk-Search/finding-percentage/m-p/520906#M146740 <P>Here is one way to combine the two searches.</P><LI-CODE lang="markup">index=main | eval update=if(searchmatch("update*"), Host_Name, NULL) | stats dc(update) as updated, dc(Host_Name) as total | fillnull value=0 updated | eval pct=round((updated*100)/total,2)</LI-CODE> Tue, 22 Sep 2020 18:03:38 GMT https://community.splunk.com/t5/Splunk-Search/finding-percentage/m-p/520906#M146740 richgalloway 2020-09-22T18:03:38Z