Splunk Search

Calculate a percentage on chart count over some span

nmulm
Explorer

Hi there,

I have response time data in ms in a table field ElTime. I want to band this based on 1000ms second brackets then show the counts in each band and also show the percentage. For some reason I cannot seem to get the percentage working. I have been through several solutions on here, but so far haven't found one covering my scenario. My gut is that this should be an easy one but I can't get it working.

My basic query is ~

| chart count over ElTime span=1000 |sort -ElTime

I've tried a few things nothing which I can get to work e.g.

| eventstats count as total | chart count over EntsBWElapTime span=1000,eval Percent=(count/total)*100

Sry total newbie struggling to make this work!

The results I would hope to get would be like ~

Elapsed Time (ms) Count Percentage
0 1602364 99.82%
1000 1938 0.12%
2000 199 0.01%

Any pointers are much appreciated, I would also be interested in a solution that would allow defined bands rather than just steps e.g. 0-250ms,251-500 etc etc.

N

Tags (3)
0 Karma
1 Solution

woodcock
Esteemed Legend

Try this:

... | eval ElapsedTime = case (EITime<=250, "0-250", EITime<=500, "251-500", EITime<=750, "501-750", EITime<=1000, "751-1000", 1==1, "1000+") | top limit=0 ElapsedTime

View solution in original post

0 Karma

fdi01
Motivator

try like this:

...| eventstats count as total| bucket _time span=1000ms | stats count by "EntsBWElapTime" |eval Percent=(count/total)*100 +"%"

or

...| eventstats count as total | timechart span=1000ms count by EntsBWElapTime |eval Percent=(count/total)*100 +"%" 
0 Karma

woodcock
Esteemed Legend

Try this:

... | eval ElapsedTime = case (EITime<=250, "0-250", EITime<=500, "251-500", EITime<=750, "501-750", EITime<=1000, "751-1000", 1==1, "1000+") | top limit=0 ElapsedTime
0 Karma

nmulm
Explorer

Excellent thanks this worked for me, for some reason the using eventstats \ stats count as total methods listed would not do it.

0 Karma

woodcock
Esteemed Legend

Don't forget to "Accept" my answer.

0 Karma

chimell
Motivator

Hi nmulm
Try this search code

enter something here | eventstats count as total | chart span=1000 count over EntsBWElapTime |eval Percent=(count/total)*100|table EntsBWElapTime  count Percent
0 Karma

nmulm
Explorer

Thanks for that 🙂

I think there may be an issue with the total value as the Percentage column just ends up blank, and if I include total in the table it is also blank. I am getting the counts banded correctly just not the percentages.

That was the thing that I was struggling with i.e. does eventstats calculate the total of the entire result set before the chart breaks out the EntsBWElapTIme into the relevent bands?

N

0 Karma

chimell
Motivator

In this case , i advise you to use stats command instead of eventstats

Try this

 enter something here | stats count as total | chart span=1000 count over EntsBWElapTime |eval Percent=(count/total)*100|table EntsBWElapTime  count Percent
0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...

Edge Processor Scaling, Energy & Manufacturing Use Cases, and More New Articles on ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Get More Out of Your Security Practice With a SIEM

Get More Out of Your Security Practice With a SIEMWednesday, July 31, 2024  |  11AM PT / 2PM ETREGISTER ...