Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Archive

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Calculating total in row

khanyag1

New Member

02-27-2020
06:20 AM

Hi,

I need help adding b+ c together to get a total, I will then calculate a percentage using a/combined b+c. Is this possible?

| stats dc(Users) as UsersCount by Label app

| stats sum(UsersCount) by Label

Label sum(UsersCount)

1 a 14

2 b 2

3 c 19

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

adonio

SplunkTrust

02-27-2020
12:32 PM

little clumsy solution, but maybe itll work for you

try it anywhere

```
| makeresults count=1
| eval data="1 a 14;;;2 b 2;;;3 c 19"
| makemv delim=";;;" data
| mvexpand data
| rex field=data "(?<label>[^\s]+)\s(?<app>[^\s]+)\s(?<tot_users>[^\s]+)"
| table label app tot_users
| rename COMMENT as "above generates fake data, below is solution"
| chart max(tot_users) as total over label by app
| stats values(*) as *
| mvexpand label
| eval b_plus_c = b + c
| eval percent = round(a / b_plus_c * 100, 2)
```

hope it helps

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

khanyag1

New Member

03-11-2020
06:42 AM

Thank you! I will give this a try

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

somesoni2

SplunkTrust

02-27-2020
12:55 PM

Try this (assuming field Label has values "a" "b" "c". If there are different values, update the column name in the query)

```
..your base earch
| chart dc(Users) as UsersCount by app Label | fields - app
| stats sum(*) as *
| eval total=b+c
| eval percentage=round*a*100/total,2)
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

khanyag1

New Member

03-11-2020
06:42 AM

Thank you! I will try this

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

woodcock

Esteemed Legend

03-19-2020
08:51 AM

`distinct counts`

!!! DO NOT DEPLOY THIS. Although this answer does what you asked, you should not be asking this. It is as wrong as can possibly be. This is bad math, and will lead to WRONG DECISIONS!!!!

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

woodcock

Esteemed Legend

03-11-2020
07:43 AM

What you are doing is ** NOT MATHEMATICALLY CORRECT!!!**; you cannot sum

`distinct counts`

; think about it...So do this:

```
| stats dc(Users) AS UsersCount BY Label
| eval foo="bar"
| xyseries foo Label UsersCount
| eval AplusB = A + B
| untable foo Label UsersCount
| fields - foo
| eval AplusB = if(Label = "AplusB", UsersCount, null())
| eventstats first(AplusB) AS AplusB
```

Highlighted
##

If my Label displays three labels, how do I extract the labels so that I can add them? Thanks for your response!

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

khanyag1

New Member

03-12-2020
06:12 AM

Highlighted
##

Keep in mind that this answer was for EDUCATIONAL PURPOSES ONLY. It is NOT MATHEMATICALLY VALID TO SUM distinct counts!!! DO NOT DEPLOY THIS. Although this answer does what you asked, you should not be asking this. It is as wrong as can possibly be. This is bad math, and will lead to WRONG DECISIONS!!!! I am working on a solution that will work. Stand by.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

woodcock

Esteemed Legend

03-19-2020
08:53 AM

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: Calculating total in row

woodcock

Esteemed Legend

03-19-2020
09:31 AM

See my other answer. It does it the right way keeping the values, not the counts.