How to find percentage and count using stats and eval?

[POR160893]

Hi,

I have a field "IT_Managed" and its values are "Yes" or "No".
I need the count AND percentage of events with "YES".
It appears I am not using the stats and eval commands correctly.
Here is my code:

Can you please help?
Thanks

[POR160893]

 I am trying to use a subsearch to find the TOTAL value:

But I am now getting the following error:

Can you please help?

[ITWhisperer]

Don't do it that way!

| loadjob savedsearch="andrew_nelson:renbe:Asset Registry - Security Agent Mapping" events=false
| stats count(eval(IT_Managed="Yes")) as COMP count as TOTAL
| eval percentage=100*COMP/TOTAL

[ITWhisperer]

your search
| stats count(eval(IT_Managed="Yes")) as COMP count as TOTAL
| eval percentage=100*COMP/TOTAL

[Marco_Develops]

Try the following:

|base search ...
|stats count(IT_Managed) as TOTAL
|eval IT_Managed= if(IT_Managed == "Yes" , 1,0)
|stats sum(IT_Managed) count as COMP
|eval percentage = COMP/TOTAL* 100
|table COMP percentage

 -Marco

[POR160893]

Thanks.

I ran your query and this is what I got:

I am not sure .....

[Marco_Develops]

Yes, I forgot a space in the second stats command. After taking a second look I believe that using 1 stats command will work fine. I modified the search

| baseSearch ...
|eval IT_Managed= if(IT_Managed == "Yes" , 1,0)
|stats sum(IT_Managed) count as COMP count(IT_Managed) as TOTAL
|eval percentage = COMP/TOTAL* 100
|table COMP percentage

-Marco

[POR160893]

Thanks but the percentage is incorrect:

[Marco_Develops]

Try the following: 

| baseSearch ...
|eval IT_Managed= if(IT_Managed == "Yes" , 1,0)
|stats sum(IT_Managed) count as COMP count(IT_Managed) as TOTAL
|eval percentage = (COMP/TOTAL) * 100
|table COMP percentage

If this helped, please accept as solution 🙂 

-Marco 

[POR160893]

No, still outputting just 100. I think the first eval is incorrect ...