https://community.splunk.com/t5/Splunk-Search/Percentage-calculation-based-on-derived-value-and-show-it-is-as/m-p/337354#M164391 <P>@deepa_purushothaman, for the description provided, I am expecting two columns and four rows in your data, where you want percent to be calculated based on 3rd and 4th row. Try the following run anywhere which mimics your data as per question. Commands till <CODE>| table column1 column2</CODE> generate sample data, you would need to plug in your existing query which generates first table as per your question.</P> <PRE><CODE>| makeresults | eval data="XXX|10;YYY|20;abc|30;efg|10" | makemv data delim=";" | mvexpand data | eval data=split(data,"|") | eval column1=mvindex(data,0) | eval column2=mvindex(data,1) | table column1 column2 | transpose header_field=column1 column_name=column1 | eval perc=round((efg/abc)*100,1) | transpose header_field=column1 column_name=column1 </CODE></PRE> <P>PS: This example uses <CODE>transpose</CODE> to invert the sample table in the question and perform calculation as needed. If you can share your current search query community might be able to assist you with better query by avoiding multiple transpose. Ideally you perform event related calculation in the same row and then convert to column if required.</P> Tue, 12 Dec 2017 12:50:39 GMT niketn 2017-12-12T12:50:39Z https://community.splunk.com/t5/Splunk-Search/Percentage-calculation-based-on-derived-value-and-show-it-is-as/m-p/337353#M164390 <P>My data looks something like below, here first two rows are indexed data and 3,4th rows are derived data and added as new rows after some manipulation. My question is i want to add one more new row as by calculating percentage. for example - between rows 2 &amp; 3 or 3&amp;4 .</P> <P>column1| column2<BR /> XXX| 10<BR /> YYY|20<BR /> abc|30<BR /> efg|10</P> <P>Outcome something like<BR /> column1| column2<BR /> XXX| 10<BR /> YYY|20<BR /> abc|30<BR /> efg|10<BR /> per|33 ( ie., (column1=efg/column1=abc)*100</P> <P>Please help. thanks </P> Tue, 12 Dec 2017 11:18:17 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-calculation-based-on-derived-value-and-show-it-is-as/m-p/337353#M164390 deepa_purushoth 2017-12-12T11:18:17Z https://community.splunk.com/t5/Splunk-Search/Percentage-calculation-based-on-derived-value-and-show-it-is-as/m-p/337354#M164391 <P>@deepa_purushothaman, for the description provided, I am expecting two columns and four rows in your data, where you want percent to be calculated based on 3rd and 4th row. Try the following run anywhere which mimics your data as per question. Commands till <CODE>| table column1 column2</CODE> generate sample data, you would need to plug in your existing query which generates first table as per your question.</P> <PRE><CODE>| makeresults | eval data="XXX|10;YYY|20;abc|30;efg|10" | makemv data delim=";" | mvexpand data | eval data=split(data,"|") | eval column1=mvindex(data,0) | eval column2=mvindex(data,1) | table column1 column2 | transpose header_field=column1 column_name=column1 | eval perc=round((efg/abc)*100,1) | transpose header_field=column1 column_name=column1 </CODE></PRE> <P>PS: This example uses <CODE>transpose</CODE> to invert the sample table in the question and perform calculation as needed. If you can share your current search query community might be able to assist you with better query by avoiding multiple transpose. Ideally you perform event related calculation in the same row and then convert to column if required.</P> Tue, 12 Dec 2017 12:50:39 GMT https://community.splunk.com/t5/Splunk-Search/Percentage-calculation-based-on-derived-value-and-show-it-is-as/m-p/337354#M164391 niketn 2017-12-12T12:50:39Z