Splunk Search

Calculating Percentage

monicato
Path Finder

Hello!

I'm having trouble with the syntax and function usage... I am trying to have splunk calculate the percentage of completed downloads. I first created two event types called total_downloads and completed; these are saved searches.

I tried this in the search, but it returned 0 matching fields, which isn't right, my event types are definitely not empty...:

count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

Can anyone help with finding the right command? I'm a little confused with event types and etc.? new to splunk... :<

1 Solution

Ayn
Legend

Generally speaking it's always a good idea not to try to build a whole search right away (unless you know well what you're doing), but rather take it one step at a time. In your case the reason you're getting 0 results is that everything before the first pipe character is interpreted by Splunk as being keywords it should search for. So instead of calculating the statistics you want, it will actually search for events having the text "count(eval(eventtype="total_downloads"))", "AS", "total" and so on. What you'll want to do is enter any search terms you might have first of all, then use the stats command to get the stats you're halfway through getting in the search you have now. Something like this:

<yourbasesearch> | stats count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

View solution in original post

michaeltayo
Explorer

piggybacking off of this,

could you timechart the new calculated percentage?

for example what if you wanted to graph the percentage over time, month over mont etc, in line chart or area chart?

could you provide an example

ddalling
Engager

If you want to round it and add the % you can use this:

| eval "percent"=((count/Total)*100) | eval "rounded_percent"=round('percent') | fieldformat "rounded_percent"=tostring('External_%')+"%"

monicato
Path Finder

hmm, yeah, I'm not sure what I should put. I tried putting a pipe and a command before count(... but it still doesn't find any matching events...

0 Karma

Ayn
Legend

Generally speaking it's always a good idea not to try to build a whole search right away (unless you know well what you're doing), but rather take it one step at a time. In your case the reason you're getting 0 results is that everything before the first pipe character is interpreted by Splunk as being keywords it should search for. So instead of calculating the statistics you want, it will actually search for events having the text "count(eval(eventtype="total_downloads"))", "AS", "total" and so on. What you'll want to do is enter any search terms you might have first of all, then use the stats command to get the stats you're halfway through getting in the search you have now. Something like this:

<yourbasesearch> | stats count(eval(eventtype="total_downloads")) AS total, count(eval(eventtype="completed")) AS complete | eval percent_difference=((total/complete)*100) | table percent_difference

monicato
Path Finder

ahh i see, thanks for clearing that up... it's taking me a while to understand the search engine : /

Thank you for the help! it works! : ))

0 Karma

Ayn
Legend

Then that's your problem right there 🙂

0 Karma

monicato
Path Finder

that is the entire search... >.<

0 Karma

Ayn
Legend

Could you paste your complete search, not just the portion starting with the count?

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...