topic Re: How to edit my search to calculate percentage for each row? in Splunk Search

How to edit my search to calculate percentage for each row?

sonila — Fri, 12 May 2017 19:08:36 GMT

earliest=-72h@h latest=@h index=dga | transaction  EventType maxevents=2 |stats count as total | appendcols [search earliest=-72h@h latest=@h index=dga | transaction  EventType maxevents=2| where Result="False" OR Result="false" |timechart span=1h  count  | eval time=_time-now()%259200 | timechart span=24h sum(count) as count |  tail 3 | tail 2 | eval _time=_time+now()%259200] | eval percentage=count*100/total | table count, p

Why can't it calculate the whole percentage? It calculates only for the first row

Re: How to edit my search to calculate percentage for each row?

somesoni2 — Fri, 12 May 2017 19:28:09 GMT

The first query of your's is giving only single row (output of stats) hence the field total is only populated in row1 and thus percentage is only available in row1. I believe something like this would work efficiently and give you expected result.

earliest=-72h@h latest=@h index=dga | transaction EventType maxevents=2 | eventstats count as total
| where Result="False" OR Result="false" |timechart span=1h count max(total) as total | eval time=_time-now()%259200 | timechart span=24h sum(count) as count max(total) as total | tail 2 | eval _time=_time+now()%259200 | eval percentage=count*100/total | table count, p

Re: How to edit my search to calculate percentage for each row?

sonila — Fri, 12 May 2017 20:17:01 GMT

nope doesnt work this

earliest=-72h@h latest=@h index=dga | transaction  EventType maxevents=2| where Result="False" OR Result="false" |timechart span=1h  count | eval time=_time-now()%259200 | timechart span=24h sum(count) as count |  tail 3 | tail 2 | eval _time=_time+now()%259200 | appendcols [ search earliest=-72h@h latest=@h index=dga | transaction  EventType maxevents=2 | timechart span=1h  count as total |eval time=_time-now()%259200 | timechart span=24h sum(total) as total |  tail 3 | tail 2 | eval _time=_time+now()%259200  ] | eval p=count*100/total | eval p = if(isnull(p), 0, p) |fields + p

this gave me the solution wanted

Re: How to edit my search to calculate percentage for each row?

somesoni2 — Fri, 12 May 2017 21:21:04 GMT

Could you describe what's the problem you see with the results?

Re: How to edit my search to calculate percentage for each row?

sonila — Fri, 12 May 2017 21:27:17 GMT

Your solution didnt calculate percentage of each row.
Instead my version gave me the results for each row.
earliest=-72h@h latest=@h index=dga | transaction EventType maxevents=2| where Result="False" OR Result="false" |timechart span=1h count | eval time=_time-now()%259200 | timechart span=24h sum(count) as count | tail 3 | tail 2 | eval _time=_time+now()%259200 --> this gave me the number of events of errors counted by time
and
appendcols [ search earliest=-72h@h latest=@h index=dga | transaction EventType maxevents=2 | timechart span=1h count as total |eval time=_time-now()%259200 | timechart span=24h sum(total) as total | tail 3 | tail 2 | eval _time=_time+now()%259200 ] | eval p=count*100/total ---> this gave me the total and percentage of each row

Re: How to edit my search to calculate percentage for each row?

woodcock — Sat, 13 May 2017 00:34:39 GMT

Your transaction commands look strange to me and I suspect that are gross overkill for what you are trying to do. Please show a few sample events and the desire end result. I am sure that we can create something in a much more efficient way than the path that you are on.

Re: How to edit my search to calculate percentage for each row?

aaraneta_splunk — Sat, 13 May 2017 01:50:01 GMT

@sonila - I just want to confirm: The solution you found above is the answer to your question? If yes, let me know and I can convert your comment as the answer to "Accept". If no and you want to leave your question open for other suggestions, no action needs to be taken.

Re: How to edit my search to calculate percentage for each row?

sonila — Sat, 13 May 2017 09:37:05 GMT

I need to count two events as one. thats why i used transaction command

Re: How to edit my search to calculate percentage for each row?

sonila — Sat, 13 May 2017 09:37:53 GMT

Yes this is the solution