How to display an integer as a percentage

[rchurch0505]

Good morning folks!

Version: 7.3.1.1

I can't find documentation on how to display an integer as a percentage, but also retain the ability to perform actions such as Number Formatting or inserting summary rows into a statistics table.

For example, here is the output of a table I generated.

Host Name    Column A    Column B    Column C    Column D
localhost    80%         10%         5%          100%
localhost.1  10%         12%         9%          98%
localhost.2  73%         12%         5%          100%

To generate this, I did the following

| eval perc_col_a = round(datafield / totfield)*100)."%"

So because this is now a string in the statistics table instead of a float, numeric formatting won't perform conditional formatting on the field. I also can't add a summary row with percentages.

So the ask is, is there any documentation for a feature that allows for the data to be treated numerically in the table, but displayed visually with the %?

Thanks in advance!

[dindu]

Hi,

For numeric conversion you could use convert function.

  |your_search
  |convert num(your_string_field)

In your case do all the arithmetic operations and append the % as the last step.

  | your_base_search
  |arithmetic_perations
  | eval perc_col_a = round(datafield / totfield)*100)."%"
  |rename  perc_col_a  as "Column A"

[rchurch0505]

This is pretty much exactly how I am doing it. The issue though is, when the % is present in the table, I can't perform evaluations on the fields. When I remove the %, it works great, but it doesn't have the % visually.

| stats count(tls_host) as tot_hosts,
        count(eval(column_a_value == "Enabled")) as colum_a_tot,
        count(eval(column_b_value == "Enabled")) as colum_b_tot
| eval perc_col_a = round((column_a_tot / tot_hosts)*100)."%"
| eval perc_col_b = round((column_b_tot / tot_hosts)*100)."%"
| rename perc_col_a as "Column A"
| rename perc_col_b as "Column B"
| convert num(perc_col_b)

fieldsummary, shows "Column A" as a string value, and "Column B" as an integer value.

Column A :: [{"value": "32%", "count" 131}]
Column B :: [{"value": "100","count:312}]

So essentially, any operations performed in the SPL generating the statistics table defines its type. The table evaluation is performed after the data has been provided.

There lays the problem. Adding the "%" will need to be done after the statistics table has been generated, or there needs to be a way to tell the dashboard treat the field as a numeric value instead of a string.