https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216722#M63628 <P>Examples in our docs here - <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Top">http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Top</A> </P> Thu, 07 Jan 2016 11:58:09 GMT sdaniels 2016-01-07T11:58:09Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216719#M63625 <P>Working on some client data, sample data format looks like:</P> <PRE><CODE>Item status -------------------------- AAA success BBB fail CCC pending DDD fail EEE success FFF success GGG pending HHH success III fail JJJ pending KKK success </CODE></PRE> <P>Now I want to calculate the percentage of each status field. <BR /> I want the output like below:</P> <PRE><CODE>status count percentage ----------------------------------- Success 50 50% fail 40 40% pending 10 10% </CODE></PRE> <P>plz help me with search.</P> <P>Thanks in advance..</P> Thu, 07 Jan 2016 07:29:40 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216719#M63625 SrinivasaC 2016-01-07T07:29:40Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216720#M63626 <P>It should be something like:</P> <PRE><CODE>yoursearch | top status </CODE></PRE> Thu, 07 Jan 2016 10:22:14 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216720#M63626 javiergn 2016-01-07T10:22:14Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216721#M63627 <P>try like this:</P> <PRE><CODE>...| stats count by status| eventstats sum(count) as total| eval percent = round((count/total)*100) . " %"|sort -percent | fields - total </CODE></PRE> <P>or</P> <PRE><CODE>...| top status | eval percent=percent."%" </CODE></PRE> Thu, 07 Jan 2016 10:58:44 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216721#M63627 fdi01 2016-01-07T10:58:44Z https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216722#M63628 <P>Examples in our docs here - <A href="http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Top">http://docs.splunk.com/Documentation/Splunk/6.3.2/SearchReference/Top</A> </P> Thu, 07 Jan 2016 11:58:09 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-write-a-search-to-calculate-the-percentage-of-each/m-p/216722#M63628 sdaniels 2016-01-07T11:58:09Z