https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88939#M22766 <P>I am trying to a radial gauge to report a percentage. I've built my search and the field that I want to report on has 4 different values.</P> <P>I have my basic search and then the following:</P> <PRE><CODE>| stats count by myfield | gauge count by myfield=normal* </CODE></PRE> <P>which gives me a gauge value of 4 but that only reflect the total different values of the field "severity".</P> <P>I've tried to place an eval but it doesn't take</P> <PRE><CODE>| stats count myfield1 as (search severity=normal) | stats count myfield2 as (search severity="*") | eval myfield=100*(myfield1/myfield2) | gauge myfield </CODE></PRE> Fri, 12 Oct 2012 21:27:17 GMT ronmurphy 2012-10-12T21:27:17Z https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88939#M22766 <P>I am trying to a radial gauge to report a percentage. I've built my search and the field that I want to report on has 4 different values.</P> <P>I have my basic search and then the following:</P> <PRE><CODE>| stats count by myfield | gauge count by myfield=normal* </CODE></PRE> <P>which gives me a gauge value of 4 but that only reflect the total different values of the field "severity".</P> <P>I've tried to place an eval but it doesn't take</P> <PRE><CODE>| stats count myfield1 as (search severity=normal) | stats count myfield2 as (search severity="*") | eval myfield=100*(myfield1/myfield2) | gauge myfield </CODE></PRE> Fri, 12 Oct 2012 21:27:17 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88939#M22766 ronmurphy 2012-10-12T21:27:17Z https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88940#M22767 <P>Something like this should work: </P> <P><CODE>index=bar severity=* | eval foo=if(severity=="normal",1,0) | stats count as total, sum(foo) | rename sum(foo) as foo | eval percfoo=100*(foo/total) | gauge percfoo</CODE></P> <P>Hope this helps, </P> <P>d.</P> Mon, 15 Oct 2012 00:15:37 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88940#M22767 _d_ 2012-10-15T00:15:37Z https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88941#M22768 <P>This really helps. Now what I'm trying to do is timechart these percentages, however the timechart function only seems to work on registered fields.</P> Wed, 24 Oct 2012 15:39:33 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88941#M22768 ronmurphy 2012-10-24T15:39:33Z https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88942#M22769 <P>I used something like this:</P> <P>search<BR /> | dedup ID<BR /> | eval breached = if(SLA = "Breached", 1, 0)<BR /> | eval active = if(SLA = "Active", 1, 0)<BR /> | eval met = if(SLA = "Met", 1, 0)<BR /> | eval total = 1<BR /> | stats sum(breached) AS sum_breached, sum(active) AS sum_active, sum(met) AS sum_met, sum(total) AS sum_total<BR /> | eval perc_breached=((sum_breached/sum_total)*100)<BR /> | eval perc_active=((sum_active/sum_total)*100)<BR /> | eval perc_met=((sum_met/sum_total)*100)<BR /> | gauge perc_met</P> Tue, 29 Sep 2020 09:26:02 GMT https://community.splunk.com/t5/Splunk-Search/Calculating-percentage-and-placing-in-a-radial-gauge/m-p/88942#M22769 jwch 2020-09-29T09:26:02Z