https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294305#M88867 <P>@bwindham - Are you able to share any info on your KnowBe4 Splunk config? Is there a prebuilt app from KnowBe4 or did you build the API input script yourself?</P> <P>Thank you for your time,<BR /> Scott</P> Tue, 21 Jan 2020 21:26:54 GMT s33butler 2020-01-21T21:26:54Z https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294300#M88862 <P>I have a field PP that I would like to use in eval statement to get a percentage from JSON data and using spath.</P> <P>Here is the search:</P> <PRE><CODE>index=main sourcetype=knowbe4 | head 1 | spath input=_raw path="{}.name" output=Campaign | spath input=_raw path="{}.status" output=Status | spath input=_raw path="{}.started_at" output=Started | spath input=_raw path="{}.duration" output=Duration | spath input=_raw path="{}.scheduled_count" output=Recipients | spath input=_raw path="{}.delivered_count" output=Delivered | spath input=_raw path="{}.clicked_count" output=Clicked | spath input=_raw path="{}.attachment_open_count" output="AttachOpen" | spath input=_raw path="{}.reported_count" output=Reported | spath input=_raw path="{}.phish_prone_percentage" output=PP| convert num(PP) as PPP | eval perc=(PP * 100) | table Campaign Status Started Duration Recipients Delivered Clicked "Attachment Open" Reported PP perc PPP </CODE></PRE> <P>I have values for PP and PPP but no value (null) for perc.</P> <P>Table results:</P> <PRE><CODE>Campaign Status Started Duration Recipients Delivered Clicked AttachOpen Reported PP perc PPP 2018 W-2 Active 2/13/18 4 1657 1401 141 0 140 .17 .17 </CODE></PRE> Wed, 14 Feb 2018 18:05:39 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294300#M88862 bwindham 2018-02-14T18:05:39Z https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294301#M88863 <P>Try changing <CODE>| eval perc=(PP * 100)</CODE> to <CODE>| eval perc=(PPP*100)</CODE> in your query.</P> Wed, 14 Feb 2018 21:23:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294301#M88863 somesoni2 2018-02-14T21:23:46Z https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294302#M88864 <P>yep, typo on my part</P> Sat, 17 Feb 2018 03:23:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294302#M88864 bwindham 2018-02-17T03:23:54Z https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294303#M88865 <P>@bwindham, after correcting the fieldname if your issue is resolved, then kindly accept the answer to mark this question as answered!</P> Sun, 18 Feb 2018 10:07:41 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294303#M88865 niketn 2018-02-18T10:07:41Z https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294304#M88866 <P>bwindham - I'm curious on how you are getting your knowbe4 data into Splunk? </P> <P>We are new knowbe4 customers and wanted to know if its work ingesting the data into Splunk.</P> <P>thanks, </P> <P>Dan</P> Mon, 18 Mar 2019 21:54:49 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294304#M88866 dacosta123 2019-03-18T21:54:49Z https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294305#M88867 <P>@bwindham - Are you able to share any info on your KnowBe4 Splunk config? Is there a prebuilt app from KnowBe4 or did you build the API input script yourself?</P> <P>Thank you for your time,<BR /> Scott</P> Tue, 21 Jan 2020 21:26:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-create-eval-statement-to-get-percentage-from-2-fields/m-p/294305#M88867 s33butler 2020-01-21T21:26:54Z