https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628223#M218235 <P>yeah,&nbsp; right. modified it. thanks<BR /><SPAN>226 / (2924 + 226) = 7.17%</SPAN></P> Wed, 25 Jan 2023 06:16:22 GMT vinothkumark 2023-01-25T06:16:22Z https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628189#M218218 <P>&lt; query &gt; ... | stats count by return_code fetches me the below output.<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="vinothkumark_0-1674585802845.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23521i0F79A39194C710F7/image-size/medium?v=v2&amp;px=400" role="button" title="vinothkumark_0-1674585802845.png" alt="vinothkumark_0-1674585802845.png" /></span></P><P><BR />I have to create an alert where the <STRONG>sum</STRONG> of any return_code value other than 100 and 200 should not cross 20% of the overall value.<BR /><BR />Example: from the above image, I will add the count of return_codes (other than 100 and 200 ) which will result as 226. now the count of 100 and 200 is 2924. now the&nbsp; percentage will come around 7.17 %.<BR />How do I achieve this via query?</P> Wed, 25 Jan 2023 06:15:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628189#M218218 vinothkumark 2023-01-25T06:15:29Z https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628193#M218220 <P>From the current results, use eventstats to compute the subtotals by return_code.&nbsp; Then you can calculate the percentage.</P><LI-CODE lang="markup">.. | stats count by return_code | eventstats sum(eval(return_code&lt;=200)) as OK, sum(eval(return_code&gt;200)) as KO | eval pctKO = (KO * 100) / OK</LI-CODE> Tue, 24 Jan 2023 19:01:08 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628193#M218220 richgalloway 2023-01-24T19:01:08Z https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628210#M218230 <P>Just a technical comment on the maths...</P><P>When you say that ...<STRONG><SPAN>should not cross 20% of the overall value.</SPAN></STRONG></P><P>your calculation of 7.7% indicates that failures is compared only against successes (100+200), i.e 226/2924, however, if you want it to be of 'overall value' then the formula would be</P><P>226 / (2924 + 226) = 7.17%</P><P>and&nbsp;<a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/213957">@richgalloway</a>&nbsp;formula would be</P><LI-CODE lang="markup">| eval pctKO = (KO * 100) / (OK + KO)</LI-CODE><P>&nbsp;</P> Tue, 24 Jan 2023 21:46:51 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628210#M218230 bowesmana 2023-01-24T21:46:51Z https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628223#M218235 <P>yeah,&nbsp; right. modified it. thanks<BR /><SPAN>226 / (2924 + 226) = 7.17%</SPAN></P> Wed, 25 Jan 2023 06:16:22 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628223#M218235 vinothkumark 2023-01-25T06:16:22Z https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628227#M218236 <P>Sorry I think I didn't put it in the right way.&nbsp;<BR />It calculates the return_code like below ( check KO and OK )<BR /><BR /></P><P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="vinothkumark_1-1674627569909.png" style="width: 400px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/23525iBD97DFE5FA5E6AD0/image-size/medium?v=v2&amp;px=400" role="button" title="vinothkumark_1-1674627569909.png" alt="vinothkumark_1-1674627569909.png" /></span></P><P>&nbsp;</P><P>&nbsp;But I want to calculate the highlighted ones.&nbsp;<BR />Example: 8+9+3 = 20<BR />254 + 227 = 481<BR />perc = 20*100/(20+481)=3.1%&nbsp;</P> Wed, 25 Jan 2023 06:24:38 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628227#M218236 vinothkumark 2023-01-25T06:24:38Z https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628229#M218237 <P>The eventstats should be</P><LI-CODE lang="markup">| eventstats sum(eval(if(return_code&lt;=200, count, 0))) as OK, sum(eval(if(return_code&gt;200, count, 0))) as KO | eval pctKO = (KO * 100) / (OK + KO)</LI-CODE><P>however, with your calculations this actually is 3.99%...</P><LI-CODE lang="markup">| makeresults | eval x=split("100:254,200:227,404:8,404:3,406:9", ",") | mvexpand x | rex field=x "(?&lt;return_code&gt;\d+):(?&lt;count&gt;\d+)" | table return_code count | eventstats sum(eval(if(return_code&lt;=200, count, 0))) as OK, sum(eval(if(return_code&gt;200, count, 0))) as KO | eval pctKO = (KO * 100) / (OK + KO)</LI-CODE> Wed, 25 Jan 2023 06:39:29 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-percentage-with-selective-sum-of-field-values/m-p/628229#M218237 bowesmana 2023-01-25T06:39:29Z