topic Re: Calculating Percentage in Splunk Search

Calculating Percentage

monicato — Mon, 25 Jun 2012 18:44:31 GMT

Hello!

I'm having trouble with the syntax and function usage... I am trying to have splunk calculate the percentage of completed downloads. I first created two event types called total_downloads and completed; these are saved searches.

I tried this in the search, but it returned 0 matching fields, which isn't right, my event types are definitely not empty...:

count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

Can anyone help with finding the right command? I'm a little confused with event types and etc.? new to splunk... :<

Re: Calculating Percentage

Ayn — Mon, 25 Jun 2012 19:11:23 GMT

Could you paste your complete search, not just the portion starting with the count?

Re: Calculating Percentage

monicato — Mon, 25 Jun 2012 20:00:52 GMT

that is the entire search... >.<

Re: Calculating Percentage

Ayn — Mon, 25 Jun 2012 20:04:27 GMT

Then that's your problem right there 🙂

Re: Calculating Percentage

Ayn — Mon, 25 Jun 2012 20:11:21 GMT

Generally speaking it's always a good idea not to try to build a whole search right away (unless you know well what you're doing), but rather take it one step at a time. In your case the reason you're getting 0 results is that everything before the first pipe character is interpreted by Splunk as being keywords it should search for. So instead of calculating the statistics you want, it will actually search for events having the text "count(eval(eventtype="total_downloads"))", "AS", "total" and so on. What you'll want to do is enter any search terms you might have first of all, then use the stats command to get the stats you're halfway through getting in the search you have now. Something like this:

<yourbasesearch> | stats count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

Re: Calculating Percentage

monicato — Mon, 25 Jun 2012 20:14:24 GMT

hmm, yeah, I'm not sure what I should put. I tried putting a pipe and a command before count(... but it still doesn't find any matching events...

Re: Calculating Percentage

monicato — Mon, 25 Jun 2012 20:23:14 GMT

ahh i see, thanks for clearing that up... it's taking me a while to understand the search engine : /

Thank you for the help! it works! : ))

Re: Calculating Percentage

ddalling — Fri, 03 Mar 2017 19:17:47 GMT

If you want to round it and add the % you can use this:

| eval "percent"=((count/Total)*100) | eval "rounded_percent"=round('percent') | fieldformat "rounded_percent"=tostring('External_%')+"%"

Re: Calculating Percentage

michaeltayo — Tue, 10 Sep 2019 18:19:51 GMT

piggybacking off of this,

could you timechart the new calculated percentage?

for example what if you wanted to graph the percentage over time, month over mont etc, in line chart or area chart?

could you provide an example