https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484458#M193431 <P>Try this:</P> <PRE><CODE>sourcetype="pihole:log*" tag=dns tag=network tag=resolution |stats count as total, count(eval(query_type="blocked") as blocked |eval percent=round((blocked/total)* 100,1) </CODE></PRE> Sat, 29 Feb 2020 11:35:10 GMT nickhills 2020-02-29T11:35:10Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484457#M193430 <P>I'm new to splunk and need further guidance to be able to accomplish my dashboard for Pi-Hole:</P> <P>Could some expert guide me how?</P> <P>Queries Blocked<BR /> tag=dns tag=network tag=resolution query_type=blocked |stats count</P> <P>Total Queries<BR /> sourcetype="pihole:log*" tag=dns tag=network tag=resolution query |stats count</P> <P>How do I create splunk query to get the total percentage of the two results<BR /> Queries Blocked/Total queries x 100 = ?</P> <P>I just need the exact value so i can just simply copy and paste the good answer here to my splunk field.</P> <P>Your input is highly appreciated.</P> Sat, 29 Feb 2020 10:48:24 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484457#M193430 rodrigrc 2020-02-29T10:48:24Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484458#M193431 <P>Try this:</P> <PRE><CODE>sourcetype="pihole:log*" tag=dns tag=network tag=resolution |stats count as total, count(eval(query_type="blocked") as blocked |eval percent=round((blocked/total)* 100,1) </CODE></PRE> Sat, 29 Feb 2020 11:35:10 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484458#M193431 nickhills 2020-02-29T11:35:10Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484459#M193432 <P>if i put this search query, i get the correct total no output, but with "zero" blocked output.<BR /> +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++<BR /> sourcetype="pihole:log" tag=dns tag=network tag=resolution message_type="Query"<BR /> |stats count as total, count(eval(query_type="Blocked")) as blocked <BR /> |eval percent=round((blocked/total)* 100,1)</P> <P>total blocked percent<BR /> 20433 0 0.0<BR /> +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</P> <P>And below results shows the correct no. of blocked outputs, but too many entries outputs<BR /> +++++++++++++++++++++++++++++++++++++++++++++++++++++++++++<BR /> sourcetype="pihole:log" tag=dns tag=network tag=resolution<BR /> |stats count as total, count(eval(query_type="Blocked")) as blocked <BR /> |eval percent=round((blocked/total)* 100,1)</P> <P>total blocked percent<BR /> 91921 3683 4.0<BR /> ++++++++++++++++++++++++++++++++++++++++++++++++++++++++++</P> Wed, 30 Sep 2020 04:26:13 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484459#M193432 rodrigrc 2020-09-30T04:26:13Z https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484460#M193433 <P>message_type="Query" does not have <CODE>query_type="Blocked"</CODE><BR /> and many <CODE>message_type</CODE> have <CODE>query_type="Blocked"</CODE> <BR /> you only know your logs. good luck.</P> Wed, 30 Sep 2020 04:22:52 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-create-splunk-query-to-get-the-total-percentage-of-the/m-p/484460#M193433 to4kawa 2020-09-30T04:22:52Z