Splunk AppDynamics

Bucketing Series with Math calculation (percentage)

Ade_Suryadiana
Engager

Hello,

I am struggling to convert total number of metric value from number into percentage of total value, in this case is browser type -- and it should be shown in time series bucket function,

At the moment, I am able to show based on number using following queries in time series (see attached picture)

  •  SELECT series(eventTimestamp, '1m'), count(browser) AS "Firefox" FROM browser_records WHERE browser = "Firefox"
  • SELECT series(eventTimestamp, '1m'), count(browser) AS "Non-Firefox" FROM browser_records WHERE browser != "Firefox"
  • SELECT series(eventTimestamp, '1m'), count(*) AS "Total" FROM browser_records

image.jpeg

However, I am unable to convert it into percentage (%).


I know there is filter function e.g. :

SELECT 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records

or

SELECT 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

BUT it will only return single value, not in time series as I expected.

 image.jpeg

How to combine series bucketing function and filter function to get percentage number browser in time series?

Anyone has experience before?

Labels (1)
0 Karma
1 Solution

Hiroki_Ito
Contributor

Hi @Ade.Suryadiana,

Thank you for posting to the community.

I believe you are just missing series(eventTimestamp, '1m') for percentage query.
Could you try queries like the following?

SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records
SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

Best Regards,
Hiroki

View solution in original post

Hiroki_Ito
Contributor

Hi @Ade.Suryadiana,

Thank you for posting to the community.

I believe you are just missing series(eventTimestamp, '1m') for percentage query.
Could you try queries like the following?

SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records
SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

Best Regards,
Hiroki

Ade_Suryadiana
Engager

Thank you @Hiroki.Ito , it works.

Get Updates on the Splunk Community!

Fueling your curiosity with new Splunk ILT and eLearning courses

At Splunk Education, we’re driven by curiosity—both ours and yours! That’s why we’re committed to delivering ...

Splunk AI Assistant for SPL 1.1.0 | Now Personalized to Your Environment for Greater ...

Splunk AI Assistant for SPL has transformed how users interact with Splunk, making it easier than ever to ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureOn Demand Now Step boldly into the AI revolution with enhanced security ...