topic Re: Use an eval statement to find a percentage in Splunk Search

Use an eval statement to find a percentage

jregexsaurus — Tue, 18 May 2021 20:18:33 GMT

index=proxy sourcetype=bar
| stats count by blockedAction
| addtotals fieldname=grandTotal
| eval percentBlocked = round((blockedAction/grandTotal)*100,1)

I'm trying to show the amount blocked as a percent of total traffic. BlockedAction is a field that was created.

Re: Use an eval statement to find a percentage

bowesmana — Tue, 18 May 2021 23:24:15 GMT

The simplest way is to use the top command

index=proxy sourcetype=bar | top 0 blockedAction

but you can do this other ways, such as

index=proxy sourcetype=bar | stats count by blockedAction | eventstats sum(count) as grandTotal | eval percentBlocked = round((count/grandTotal)*100,1) | fields - grandTotal

Hope this helps

Re: Use an eval statement to find a percentage

richgalloway — Tue, 18 May 2021 23:31:04 GMT

It would be helpful to know what results you get from that query, but I expect you get no results. If you do get results then they're likely to be inaccurate because the blockedAction field is a label rather than a count.

Try this variation on your query.

index=proxy sourcetype=bar | stats count as grandTotal, sum(eval(blockedAction="blocked")) as blockedCount | eval percentBlocked = round((blockedCount/grandTotal)*100,1)