<?xml version="1.0" encoding="UTF-8"?>
<rss xmlns:content="http://purl.org/rss/1.0/modules/content/" xmlns:dc="http://purl.org/dc/elements/1.1/" xmlns:rdf="http://www.w3.org/1999/02/22-rdf-syntax-ns#" xmlns:taxo="http://purl.org/rss/1.0/modules/taxonomy/" version="2.0">
  <channel>
    <title>topic Re: How to Calculate the Percentage of each entry in Splunk Search</title>
    <link>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566584#M197446</link>
    <description>&lt;P&gt;Hi Ismo,&lt;/P&gt;&lt;P&gt;your solution works. Thanks! &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
    <pubDate>Fri, 10 Sep 2021 08:30:48 GMT</pubDate>
    <dc:creator>Sentira</dc:creator>
    <dc:date>2021-09-10T08:30:48Z</dc:date>
    <item>
      <title>How to Calculate the Percentage of each entry</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566571#M197441</link>
      <description>&lt;P&gt;I have the following SPL and I want to show table below. The value of&amp;nbsp;Total must be equal to count of events (1588).&amp;nbsp; How can I pur the total count of events into Total variable?&lt;BR /&gt;&lt;BR /&gt;index=abc&amp;nbsp;&lt;BR /&gt;| stats count as Count by reason_code&lt;BR /&gt;| where reason_code != "false"&lt;BR /&gt;| addtotals col=t labelfield=reason_code label="Retrieval task cancelled" fieldname="Percentage"&lt;BR /&gt;| eval "Percentage"= round((Count/Total) * 100,2)."%"&lt;BR /&gt;&lt;BR /&gt;&lt;span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="image.png" style="width: 999px;"&gt;&lt;img src="https://community.splunk.com/t5/image/serverpage/image-id/15938i145F7C3712CF5CB8/image-size/large?v=v2&amp;amp;px=999" role="button" title="image.png" alt="image.png" /&gt;&lt;/span&gt;&lt;/P&gt;</description>
      <pubDate>Fri, 10 Sep 2021 06:36:53 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566571#M197441</guid>
      <dc:creator>Sentira</dc:creator>
      <dc:date>2021-09-10T06:36:53Z</dc:date>
    </item>
    <item>
      <title>Re: How to Calculate the Percentage of each entry</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566574#M197442</link>
      <description>&lt;P&gt;Hi&lt;/P&gt;&lt;P&gt;Did this help you?&lt;/P&gt;&lt;LI-CODE lang="markup"&gt;index=abc 
| stats count as Count by reason_code
| eventstats sum(Count) as Total 
| where reason_code != "false"
| addtotals col=t labelfield=reason_code label="Retrieval task cancelled" fieldname="Percentage"
| eval "Percentage"= round((Count/Total) * 100,2)."%"&lt;/LI-CODE&gt;&lt;P&gt;r. Ismo&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 10 Sep 2021 06:46:56 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566574#M197442</guid>
      <dc:creator>isoutamo</dc:creator>
      <dc:date>2021-09-10T06:46:56Z</dc:date>
    </item>
    <item>
      <title>Re: How to Calculate the Percentage of each entry</title>
      <link>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566584#M197446</link>
      <description>&lt;P&gt;Hi Ismo,&lt;/P&gt;&lt;P&gt;your solution works. Thanks! &lt;span class="lia-unicode-emoji" title=":slightly_smiling_face:"&gt;🙂&lt;/span&gt;&lt;/P&gt;&lt;P&gt;&amp;nbsp;&lt;/P&gt;</description>
      <pubDate>Fri, 10 Sep 2021 08:30:48 GMT</pubDate>
      <guid>https://community.splunk.com/t5/Splunk-Search/How-to-Calculate-the-Percentage-of-each-entry/m-p/566584#M197446</guid>
      <dc:creator>Sentira</dc:creator>
      <dc:date>2021-09-10T08:30:48Z</dc:date>
    </item>
  </channel>
</rss>

