Hi,
I have a field "IT_Managed" and its values are "Yes" or "No".
I need the count AND percentage of events with "YES".
It appears I am not using the stats and eval commands correctly.
Here is my code:
Can you please help?
Thanks
I am trying to use a subsearch to find the TOTAL value:
But I am now getting the following error:
Can you please help?
Don't do it that way!
| loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent Mapping" events=false
| stats count(eval(IT_Managed="Yes")) as COMP count as TOTAL
| eval percentage=100*COMP/TOTAL
your search
| stats count(eval(IT_Managed="Yes")) as COMP count as TOTAL
| eval percentage=100*COMP/TOTAL
Try the following:
|base search ...
|stats count(IT_Managed) as TOTAL
|eval IT_Managed= if(IT_Managed == "Yes" , 1,0)
|stats sum(IT_Managed) count as COMP
|eval percentage = COMP/TOTAL* 100
|table COMP percentage
-Marco
Yes, I forgot a space in the second stats command. After taking a second look I believe that using 1 stats command will work fine. I modified the search
| baseSearch ...
|eval IT_Managed= if(IT_Managed == "Yes" , 1,0)
|stats sum(IT_Managed) count as COMP count(IT_Managed) as TOTAL
|eval percentage = COMP/TOTAL* 100
|table COMP percentage
-Marco
Thanks but the percentage is incorrect:
Try the following:
| baseSearch ...
|eval IT_Managed= if(IT_Managed == "Yes" , 1,0)
|stats sum(IT_Managed) count as COMP count(IT_Managed) as TOTAL
|eval percentage = (COMP/TOTAL) * 100
|table COMP percentage
If this helped, please accept as solution 🙂
-Marco
No, still outputting just 100. I think the first eval is incorrect ...