topic Re: How to calculate percentages with multiple count function in Splunk Search

How to calculate percentages with multiple count function？

homer07 — Thu, 02 Sep 2021 08:33:07 GMT

I'm trying to calculate percentages based on the number of events per vary group. There are actually a lot of events, so can't use method like count(eval(...)). The summary of events is as follows:

color ------ green red greed greed red

Here's my search so far:

How do I replace the hardcore variable value "total" with count() function or other methods?
Any help would be appreciated.

Re: How to calculate percentages with multiple count function

PickleRick — Thu, 02 Sep 2021 08:04:46 GMT

There is probably another way. But I'd do your initial search

index="test" sourcetype="csv" | stats count as numColor by color

Then I'd add eventstats to have sum of the counts in every row

|eventstats sum(count) as totalcolors

So now you can simply evaluate

| eval percentage=numColor/totalcolors

Re: How to calculate percentages with multiple count function

homer07 — Thu, 02 Sep 2021 08:27:32 GMT

I tried your method, but it doesn't seem to work to use two count function in the same search.

Re: How to calculate percentages with multiple count function

PickleRick — Thu, 02 Sep 2021 10:39:11 GMT

Sorry, my mistake. sum(numColor), not sum(count). You renamed the column in your stats.

| makeresults 
| eval _raw="red
green
red
blue
green
red
red
green" 
| multikv noheader=t
| table Column_1 
| rename Column_1 as color| stats count as numColor by color |eventstats sum(numColor) as totalcolors 
| eval percentage=numColor/totalcolors 
| fields - totalcolors
| fieldformat percentage=round(percentage*100,1)

Re: How to calculate percentages with multiple count function

homer07 — Thu, 02 Sep 2021 10:46:40 GMT

Thanks, it's great!