https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252952#M75703 <P>Try this search</P> <PRE><CODE>* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage </CODE></PRE> Tue, 12 Jul 2016 19:12:50 GMT somesoni2 2016-07-12T19:12:50Z https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252950#M75701 <P>Hi everybody!</P> <P>My database has to many properties, but important properties to set in my Dashboard starting with "U" (U12A8_TARGETOBJECTSTORENAME, U1708_DOCUMENTTITLE, U1903_ARCHIVALDATE, U2A76_CMSEARCHSCHEMAVERSION, U2D52_ICNAUTORUN, U2E68_ICNCLASSNAME, U3975_TARGETOBJECTCLASSID............) </P> <P>Currently in my Splunk dashboard, I created a "Bar Panel".</P> <P>My search is:</P> <PRE><CODE>* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE" </CODE></PRE> <P><IMG src="https://community.splunk.com/storage/temp/145259-validrequest.png" alt="alt text" /><BR /> My result is perfect, but I prefer to have my result as a percentage, so I want to replace "Count" by "Percentage"...</P> <P>So I have to replace count by total like:</P> <PRE><CODE> percentage = ("U*" * 100) / TOTAL but I don't know how to do that with the "U*" </CODE></PRE> <P>I define TOTAL like this:</P> <PRE><CODE>* | stats count(U*) as U*, count(U1708_DOCUMENTTITLE) as TOTAL | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE" </CODE></PRE> <P>Do you know how I can do that?</P> <P>Thanx a lot for answers!</P> Tue, 29 Sep 2020 10:11:37 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252950#M75701 splunkids75 2020-09-29T10:11:37Z https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252951#M75702 <P>Add this to the end</P> <PRE><CODE>... | eval perc=tostring(round((Count*100)/Total, 2), "commas")."%" </CODE></PRE> Tue, 12 Jul 2016 19:04:45 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252951#M75702 sundareshr 2016-07-12T19:04:45Z https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252952#M75703 <P>Try this search</P> <PRE><CODE>* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage </CODE></PRE> Tue, 12 Jul 2016 19:12:50 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252952#M75703 somesoni2 2016-07-12T19:12:50Z https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252953#M75704 <P>Hi Sundareshr!</P> <P>Thanx for your answer!</P> Wed, 13 Jul 2016 08:13:18 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252953#M75704 splunkids75 2016-07-13T08:13:18Z https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252954#M75705 <P>Hi Somesoni2</P> <P>Thanx for your answer! That work fine but I have a little bug with the result, I search to correct it :<BR /> Splunk say that total is 1096 but it's 1068.</P> <P>Thanx again!</P> Wed, 13 Jul 2016 08:14:59 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-present-my-search-results-as-a-percentage-instead-of-a/m-p/252954#M75705 splunkids75 2016-07-13T08:14:59Z