Splunk Search

Calculate total and percentage of Incidents?

priya1926
Path Finder

Hi friends,

 

I am trying to get total resolved incidents, open incident and total incidents each day. I am getting the information from same source and Index. How do I assign resolved, open and total to separate variable and get the count of each and percentage too?

Please suggest

Thanks in Advance

Labels (2)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
| bin _time span=1d
| stats count as total count(eval(state=="OPEN")) as open count (eval(state=="RESOLVED")) as resolved by _time
0 Karma
Get Updates on the Splunk Community!

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...

[Live Demo] Watch SOC transformation in action with the reimagined Splunk Enterprise ...

Overwhelmed SOC? Splunk ES Has Your Back Tool sprawl, alert fatigue, and endless context switching are making ...

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...