Splunk AppDynamics

Bucketing Series with Math calculation (percentage)

Ade_Suryadiana
Engager

Hello,

I am struggling to convert total number of metric value from number into percentage of total value, in this case is browser type -- and it should be shown in time series bucket function,

At the moment, I am able to show based on number using following queries in time series (see attached picture)

  •  SELECT series(eventTimestamp, '1m'), count(browser) AS "Firefox" FROM browser_records WHERE browser = "Firefox"
  • SELECT series(eventTimestamp, '1m'), count(browser) AS "Non-Firefox" FROM browser_records WHERE browser != "Firefox"
  • SELECT series(eventTimestamp, '1m'), count(*) AS "Total" FROM browser_records

image.jpeg

However, I am unable to convert it into percentage (%).


I know there is filter function e.g. :

SELECT 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records

or

SELECT 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

BUT it will only return single value, not in time series as I expected.

 image.jpeg

How to combine series bucketing function and filter function to get percentage number browser in time series?

Anyone has experience before?

Labels (1)
0 Karma
1 Solution

Hiroki_Ito
Contributor

Hi @Ade.Suryadiana,

Thank you for posting to the community.

I believe you are just missing series(eventTimestamp, '1m') for percentage query.
Could you try queries like the following?

SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records
SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

Best Regards,
Hiroki

View solution in original post

Hiroki_Ito
Contributor

Hi @Ade.Suryadiana,

Thank you for posting to the community.

I believe you are just missing series(eventTimestamp, '1m') for percentage query.
Could you try queries like the following?

SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser = "Firefox") / count(*) AS "% Firefox" FROM browser_records
SELECT series(eventTimestamp, '1m'), 100*filter(count(*), browser != "Firefox") / count(*) AS "% Non-Firefox" FROM browser_records

Best Regards,
Hiroki

Ade_Suryadiana
Engager

Thank you @Hiroki.Ito , it works.

Get Updates on the Splunk Community!

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI! Discover how Splunk’s agentic AI ...