topic Splunk query to build a table with total event count, sub event count and sub event in percent in Splunk Search

Splunk query to build a table with total event count, sub event count and sub event in percent

cbiraris — Wed, 23 Oct 2024 16:24:49 GMT

Hi Team,
i am trying to design a query which show be result like total event count, sub event count and sub event in percent. can you please help with query

For example below table :
Work_Month_week | total_week_day|work day of week| Number of work hours | percent work hours
1 | 3 | Mon | 2 | % |Tus | 4 | %
|Tus | 4 | %
2 | 2 | Mon | 2 | % |Tus | 4 | %
3 | 3 | Mon | 3 | % |Tus | 5 | %
|thu | 4 | %

Re: Splunk query to build a table with total event count, sub event count and sub event in percent

yuanliu — Thu, 24 Oct 2024 05:35:31 GMT

First things first. What is a "sub event"? How do you get "subevent"? How do you count "subevent"? Secondly, please construct your desired output like a real table (e.g., by using the table template above, craft HTML table, or some means suitable for you). The illustration you give is not even aligned and impossible to interpret.

Re: Splunk query to build a table with total event count, sub event count and sub event in percent

ITWhisperer — Thu, 24 Oct 2024 10:05:04 GMT

It is usually easier for us to help you when you shows us what events you are working with, but in lieu of that, assuming you have events with the following fields: Work_Month_week, "work day of week", "Number of work hours", you could try something like this

| table Work_Month_week, "work day of week", "Number of work hours" | eventstats count as total_week_day sum("Number of work hours") as Week_total by Work_Month_week | eval "percent work hours"=100*'Number of work hours'/Week_total