https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77318#M19538 <P>I'm writing a search query that needs to look for a specific word SPECIFIC_WORD in the logs of host HOST_X and then determine how many times that searched term comes up when compared to overall. Looking for something along the lines of:</P> <P>1) search: host='HOST_X' =&gt; it will yield to say 100 results<BR /> 2) search: host='HOST_X' "SPECIFC_WORD" =&gt; it will yield to say 20 results<BR /> 3) do a percentage out of total =&gt; 20%<BR /> 4) be able to do the best graph by date_hour of step_2/step_1</P> <P>I've done something like that already:</P> <P>host="HOST_X" | stats count as total by date_hour | join [search host="HOST_X" "SPECIFIC_WORD" | stats count as something by date_hour] | eval percent_out_of=(something/total)*100 </P> <P>That seems to give me what I'm looking for, but only see total in the graph. It could be that the total number is just too large, but I'm not sure)</P> Mon, 28 Sep 2020 14:52:07 GMT mkarimi 2020-09-28T14:52:07Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77318#M19538 <P>I'm writing a search query that needs to look for a specific word SPECIFIC_WORD in the logs of host HOST_X and then determine how many times that searched term comes up when compared to overall. Looking for something along the lines of:</P> <P>1) search: host='HOST_X' =&gt; it will yield to say 100 results<BR /> 2) search: host='HOST_X' "SPECIFC_WORD" =&gt; it will yield to say 20 results<BR /> 3) do a percentage out of total =&gt; 20%<BR /> 4) be able to do the best graph by date_hour of step_2/step_1</P> <P>I've done something like that already:</P> <P>host="HOST_X" | stats count as total by date_hour | join [search host="HOST_X" "SPECIFIC_WORD" | stats count as something by date_hour] | eval percent_out_of=(something/total)*100 </P> <P>That seems to give me what I'm looking for, but only see total in the graph. It could be that the total number is just too large, but I'm not sure)</P> Mon, 28 Sep 2020 14:52:07 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77318#M19538 mkarimi 2020-09-28T14:52:07Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77319#M19539 <P>Actually, you should be able to do this without a join.</P> <P><CODE>host="HOST_X" | eval does_match = if(searchmatch("SPECIFIC_WORD"),1,0) | stats sum(does_match) as Specific_Word count as Total by date_hour | eval percent_out_of = (Specific_Word/count)*100</CODE></P> Mon, 30 Sep 2013 21:55:41 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77319#M19539 alacercogitatus 2013-09-30T21:55:41Z https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77320#M19540 <P>thanks for the help. Is it possible to show them both in the same time vs count column graph? I know I can change the graph type but it shows them next to each other in the column graph instead of the same column.</P> Wed, 02 Oct 2013 16:33:09 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-search-for-a-Term-then-get-the-Percentage-out-of-Total/m-p/77320#M19540 mkarimi 2013-10-02T16:33:09Z