topic Re: addcoltotals : do not sum percentages in Splunk Search

addcoltotals : do not sum percentages

splunkreal — Mon, 25 Jul 2016 15:14:09 GMT

Hello,

I'd like to do the following (screenshot at http://hpics.li/49c6c08), do not sum percentages but just following a calculation rule.

Thanks for your help.

Screenshot

Re: addcoltotals : do not sum percentages

sundareshr — Mon, 25 Jul 2016 15:30:25 GMT

Try this

... | eval "Recherches  sans rsultat" = if(Recherches="TOTAL", round(Rien/TOTAL, 2), "Recherches  sans rsultat")

Re: addcoltotals : do not sum percentages

woodcock — Mon, 25 Jul 2016 19:50:52 GMT

Like this (once you fix the umlauts):

... | eval $Recherches sans rsultat$ = if(like(Recherches, "TOTAL"), round((Rien/TOTAL), 2), "Recherches sans rsultat")

Re: addcoltotals : do not sum percentages

splunkreal — Tue, 29 Sep 2020 10:18:47 GMT

Solved, thanks guy.

final search :

| multisearch [ search index="xxx" sourcetype="xxx_Recherche" | where NB_Resultat = 0 | rename NB_Resultat as SZERO ] [ search index="xxx" sourcetype="xxx_Recherche" | where NB_Resultat > 0 | rename NB_Resultat as AZERO ] | stats count(AZERO) as totalsearch, count(SZERO) as totalfailed by Resultat | eval wresult=round(totalfailed/(totalfailed+totalsearch)*100,0) | eval ctotal=totalfailed+totalsearch | eventstats sum(ctotal) as sum_ctotal | eval Un=round(ctotal/sum_ctotal*100,0) | eval Recherches=case(Resultat="null","Cadas (U".Un."%)",Resultat="EXACT","Exact (U".Un."%)",Resultat="APPROXIMATIF","Approximatif (U".Un."%)") | table Recherches,totalsearch,totalfailed, ctotal, wresult | eval zresult=tostring(wresult) + "%" | addcoltotals labelfield=Recherches label=TOTAL | rename totalsearch as "Résultats trouvés", totalfailed as "Rien", zresult as "Recherches sans résultat", ctotal as TOTAL | fields - wresult | eval "Recherches sans résultat"=if(like(Recherches,"TOTAL"),round((Rien/TOTAL),2)*100,round(Rien/TOTAL*100,0))

Re: addcoltotals : do not sum percentages

woodcock — Tue, 26 Jul 2016 13:12:30 GMT

OK, now click Accept for the answer that you like best to close the question.

Re: addcoltotals : do not sum percentages

splunkreal — Tue, 26 Jul 2016 14:26:44 GMT

Ok thanks again 🙂