Splunk AppDynamics

Bucketing Series with Math calculation (percentage)

Ade_Suryadiana
Engager

Hello,

I am struggling to convert total number of metric value from number into percentage of total value, in this case is browser type -- and it should be shown in time series bucket function,

At the moment, I am able to show based on number using following queries in time series (see attached picture)

  •  SELECT series(eventTimestamp, '1m'), count(browser) AS "Firefox" FROM browser_records WHERE browser = "Firefox"
  • SELECT series(eventTimestamp, '1m'), count(browser) AS "Non-Firefox" FROM browser_records WHERE browser != "Firefox"
  • SELECT series(eventTimestamp, '1m'), count(*) AS "Total" FROM browser_records

image.jpeg

However, I am unable to convert it into percentage (%).


I know there is filter function e.g. :

SELECT 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records

or

SELECT 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

BUT it will only return single value, not in time series as I expected.

 image.jpeg

How to combine series bucketing function and filter function to get percentage number browser in time series?

Anyone has experience before?

Labels (1)
0 Karma
1 Solution

Hiroki_Ito
Contributor

Hi @Ade.Suryadiana,

Thank you for posting to the community.

I believe you are just missing series(eventTimestamp, '1m') for percentage query.
Could you try queries like the following?

SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records
SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

Best Regards,
Hiroki

View solution in original post

Hiroki_Ito
Contributor

Hi @Ade.Suryadiana,

Thank you for posting to the community.

I believe you are just missing series(eventTimestamp, '1m') for percentage query.
Could you try queries like the following?

SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records
SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

Best Regards,
Hiroki

Ade_Suryadiana
Engager

Thank you @Hiroki.Ito , it works.

Get Updates on the Splunk Community!

Upcoming Webinar: Unmasking Insider Threats with Slunk Enterprise Security’s UEBA

Join us on Wed, Dec 10. at 10AM PST / 1PM EST for a live webinar and demo with Splunk experts! Discover how ...

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...