https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286258#M86662 <P>Can you provide available fields and some sample data from the lookup and expected output?</P> Thu, 02 Jun 2016 16:08:09 GMT somesoni2 2016-06-02T16:08:09Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286257#M86661 <P>I'm trying build a bar chart from an asset list that shows by bunit what percentage of a field called <STRONG>last</STRONG> has a value in it.<BR /> I used <CODE>isnotnull</CODE> to create a field with yes/no values, but I'm not sure how to show the percentage.</P> <PRE><CODE>| inputlookup my_assets.csv | eval percentage=if(isnotnull(last),"yes","no") </CODE></PRE> Thu, 02 Jun 2016 15:54:24 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286257#M86661 jsmith_splunk 2016-06-02T15:54:24Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286258#M86662 <P>Can you provide available fields and some sample data from the lookup and expected output?</P> Thu, 02 Jun 2016 16:08:09 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286258#M86662 somesoni2 2016-06-02T16:08:09Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286259#M86663 <P>dns, nt_host, ip, owner, bunit, category, last<BR /> servera.mydomain.com,servera,1.1.1.1,Mark,groupa,linux,6/1/2016 12:08:34<BR /> serverb.mydomain.com,serverb,1.1.12,Brian,groupb,windows,,</P> <P>I can't tell if I'm on the right track or not, I've built the query out to this, but I'm not getting a return for the field count</P> <PRE><CODE>| inputlookup my_assets.csv | eval hasvalue=if(isnotnull(last),"yes","no") | stats sum(hasvalue=yes) as count by bunit | eventstats sum(hasvalue=no) as total | eval percent = round(count/total,2) </CODE></PRE> Thu, 02 Jun 2016 16:22:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286259#M86663 jsmith_splunk 2016-06-02T16:22:46Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286260#M86664 <P>You're in right direction. Try like this (using just the count will give total number of rows and count(field) will give count where field has a value)</P> <PRE><CODE> | inputlookup my_assets.csv | stats count as total count(last) as count by bunit | eval percent = round(count/total,2) </CODE></PRE> Thu, 02 Jun 2016 16:31:14 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286260#M86664 somesoni2 2016-06-02T16:31:14Z https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286261#M86665 <P>That was much easier than the direction I was going.<BR /> Thank you very much!</P> Thu, 02 Jun 2016 16:57:20 GMT https://community.splunk.com/t5/Splunk-Search/How-to-search-the-percentage-of-values-in-a-field/m-p/286261#M86665 jsmith_splunk 2016-06-02T16:57:20Z