Calculating Percentage

[monicato]

Hello!

I'm having trouble with the syntax and function usage... I am trying to have splunk calculate the percentage of completed downloads. I first created two event types called total_downloads and completed; these are saved searches.

I tried this in the search, but it returned 0 matching fields, which isn't right, my event types are definitely not empty...:

count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

Can anyone help with finding the right command? I'm a little confused with event types and etc.? new to splunk... :<

[michaeltayo]

piggybacking off of this,

could you timechart the new calculated percentage?

for example what if you wanted to graph the percentage over time, month over mont etc, in line chart or area chart?

could you provide an example

[ddalling]

If you want to round it and add the % you can use this:

| eval "percent"=((count/Total)*100) | eval "rounded_percent"=round('percent') | fieldformat "rounded_percent"=tostring('External_%')+"%"

[monicato]

hmm, yeah, I'm not sure what I should put. I tried putting a pipe and a command before count(... but it still doesn't find any matching events...

[Ayn · Accepted solution]

Generally speaking it's always a good idea not to try to build a whole search right away (unless you know well what you're doing), but rather take it one step at a time. In your case the reason you're getting 0 results is that everything before the first pipe character is interpreted by Splunk as being keywords it should search for. So instead of calculating the statistics you want, it will actually search for events having the text "count(eval(eventtype="total_downloads"))", "AS", "total" and so on. What you'll want to do is enter any search terms you might have first of all, then use the stats command to get the stats you're halfway through getting in the search you have now. Something like this:

<yourbasesearch> | stats count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

[monicato]

ahh i see, thanks for clearing that up... it's taking me a while to understand the search engine : /

Thank you for the help! it works! : ))

[Ayn]

Then that's your problem right there 🙂

[monicato]

that is the entire search... >.<

[Ayn]

Could you paste your complete search, not just the portion starting with the count?