https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376339#M169582 <P>...search<BR /> | eval Type=case(like(publishId,"%U"),"UnSubscribed",like(publishId,"%S"),"Subscribed") <BR /> | stats dc(accountExId) as TotalAccounts count(tile) as count by Type </P> <P>How do I get a percentage after the above results?<BR /> If Subscribed: eval round(count/TotalAccounts*100,2)<BR /> If UnSubscribed: eval round(count/totalAccounts*100,2)</P> Tue, 29 Sep 2020 19:22:24 GMT dwong2 2020-09-29T19:22:24Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376339#M169582 <P>...search<BR /> | eval Type=case(like(publishId,"%U"),"UnSubscribed",like(publishId,"%S"),"Subscribed") <BR /> | stats dc(accountExId) as TotalAccounts count(tile) as count by Type </P> <P>How do I get a percentage after the above results?<BR /> If Subscribed: eval round(count/TotalAccounts*100,2)<BR /> If UnSubscribed: eval round(count/totalAccounts*100,2)</P> Tue, 29 Sep 2020 19:22:24 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376339#M169582 dwong2 2020-09-29T19:22:24Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376340#M169583 <P>Try like this</P> <PRE><CODE>...search | eval Type=case(like(publishId,"%U"),"UnSubscribed",like(publishId,"%S"),"Subscribed") | stats dc(accountExId) as TotalAccounts count(tile) as count by Type | eval Percentage=round(count/TotalAccounts*100,2) </CODE></PRE> Mon, 07 May 2018 18:52:26 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376340#M169583 somesoni2 2018-05-07T18:52:26Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376341#M169584 <P>Didn't know that the eval Percentage would calculate for both Subscribed and UnSubscribed with one statement. Thought that I would have to explicitly call it out. Anyways, works like a charm. Thank You!</P> Mon, 07 May 2018 20:31:19 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376341#M169584 dwong2 2018-05-07T20:31:19Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376342#M169585 <P>Yes.. with stats command, both values are coming under single field 'Type', so single eval (which is done for each row) is sufficient.</P> Mon, 07 May 2018 20:37:21 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376342#M169585 somesoni2 2018-05-07T20:37:21Z https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376343#M169586 <P>Just checked the calculations and something is off with my calc's..<BR /> For the count(tile) as count by Type:<BR /> ...this is the data:<BR /> accountId=12345678<BR /> tile=tile1</P> <P>accountId=87654321<BR /> tile=tile2</P> <P>accountId=12345678<BR /> tile=tile3</P> <P>How can I get the distinct count for accountId? For the above example, I only want to count accountId twice because all I care about is if the accountId has at least one entry for tile... so the count should be only 2.</P> Mon, 07 May 2018 21:59:19 GMT https://community.splunk.com/t5/Splunk-Search/Get-percentage-after-case-and-stats-calculations/m-p/376343#M169586 dwong2 2018-05-07T21:59:19Z