Getting Data In

How do I split out a result So that I have a count of True and False

New Member

here is what I am trying to do I have a bunch of IP address's
Source Count 19984 18314 15660 7045 3709 2422 1946 1660 1592 1395 1276 1003 947 780 730 704 629 610 577 569 531 464

And I would like to see that percentage of my IP addresses come from 10.150 and what percentage does not. So I would like to see
Vlan150 70%
other 30%

Any help would be appreciated

0 Karma

Revered Legend

Try something like this

your current search giving Source Count | eval Source=if(like(Source,"10.150.%"),"VLAN 150","Others") | stats sum(Count) as Count by Source | eventstats sum(Count) as Total | eval Perc=round(Count*100/Total,2) | table Source Perc
0 Karma

New Member
| eval network=if(cidrmatch("",Source), "Vlan150", "Other") | top network limit=0

This is great way to separate out events based on a network and is documented in the splunk eval command at the below link.

0 Karma

Esteemed Legend

Like this:

... | stats count count(eval(source=10.150.*)) AS Vlan | eval Vlan = 100(Vlan/count) | eval other = 100-Vlan
0 Karma
.conf21 Now Fully Virtual!
Register for FREE Today!

We've made .conf21 totally virtual and totally FREE! Our completely online experience will run from 10/19 through 10/20 with some additional events, too!