https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11105#M675 <P>Thanks much. Could you explain how this actually works? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 16 Apr 2010 00:33:05 GMT sranga 2010-04-16T00:33:05Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11099#M669 <P>Hi</P> <P>Say I have the following log statements (generated throughout the day): </P> <PRE><CODE>id=111,type=2,field1=y id=141,type=23,field1=y id=131,type=21,field1=n id=121,type=27,field1=n ... ... </CODE></PRE> <P>How do I calculate the following?<BR /> Number of events with field1='y' / Number of total events for that day</P> <P>Thanks for your help.</P> Thu, 08 Apr 2010 04:18:44 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11099#M669 sranga 2010-04-08T04:18:44Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11100#M670 <P><CODE>sourcetype=mylogs | stats count(eval(field1=="y")) as ycount, count as totalcount | eval pct=ycount/totalcount</CODE></P> Thu, 08 Apr 2010 04:45:44 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11100#M670 gkanapathy 2010-04-08T04:45:44Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11101#M671 <P>If you don't care about events where field1 doesn't exist at all, you could do:</P> <PRE><CODE>... | top field1 | search field1=y </CODE></PRE> <P>Since the top command calculates percentage automatically.</P> Thu, 08 Apr 2010 06:40:13 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11101#M671 Dan 2010-04-08T06:40:13Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11102#M672 <P>Thanks for the response. Certain events may not have the field and we still want to include them in the count.</P> Fri, 09 Apr 2010 00:22:11 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11102#M672 sranga 2010-04-09T00:22:11Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11103#M673 <P>Thanks. This solution works in calculating the percentage. Is there a way to chart this data over time?</P> Fri, 09 Apr 2010 00:44:30 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11103#M673 sranga 2010-04-09T00:44:30Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11104#M674 <P><CODE>sourcetype=mylogs | timechart count(eval(field1=="y")) as ycount, count as totalcount | eval pct=ycount/totalcount</CODE></P> Fri, 09 Apr 2010 04:39:50 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11104#M674 gkanapathy 2010-04-09T04:39:50Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11105#M675 <P>Thanks much. Could you explain how this actually works? <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> Fri, 16 Apr 2010 00:33:05 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11105#M675 sranga 2010-04-16T00:33:05Z https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11106#M676 <P>Its asking stats to count the number of rows in which the eval expression is true, and return that number into a field called ycount. Then asking it to calculate the total number of rows and return that as a field called 'totalcount'.</P> Fri, 23 Apr 2010 08:59:27 GMT https://community.splunk.com/t5/Splunk-Search/Calculate-the-percentage-of-logs-with-a-certain-criteria-among/m-p/11106#M676 sideview 2010-04-23T08:59:27Z