Hello,
I need to do a percentage calculation, but I cannot.
I have the data as follows:
It is just a field named action_group, and inside it, I have only the values "sent", "open", and "click". I need to calculate the percentage of open in relation to sent and click in relation to open.
Jé tried with the eval command in a subsearch, but nothing has worked.
Anyone have any tips on how I can do this?
Thank you!!!
Try this.
<your search for events that contain action_group>
| stats count(eval(action_group="sent")) as sent, count(eval(action_group="open")) as open, count(eval(action_group="click")) as click
| eval pctOpen = round((open*100)/sent, 2), pctClick = round((click*100)/open, 2)
You should provide us with your SPL and exactly what your looking to do. This should be a simple eval like this
| eval percent = ('sent'+'click')/'open'
I also thought it would be a simple eval so, however I can not reference the field I want. This example you gave, already tried and it does not bring me any results.
I did not put the query here because I have not been able to develop anything that comes close to what I want.
My source file looks like the following (it is an export from a phishX campaign).
_id action action_group inserted_at ip user.cargo user.country user.departamento user.domain ....
The "action_group" field has the following categories: "sent", for emails that were sent, "open", for emails that were opened and "clicked" for the emails that were clicked. I want to calculate a simple percentage between sent e-mails with the ones that were open and one percentage between open e-mails and clicked ones.
I do not know how to make splunk consider the total of "sent" as the hole total to make the calculation.
Can you confirm that sent
, click
, and open
are numeric fields? If even 1 of them are non numeric then it will not return results