Splunk Search

Count Occurrences of a string in all columns dynamically

dgadjov
Explorer

The goal is just to have the percentage pass rate at the bottom of a dynamically named column that contains "Passed" or "Failed"

I have a table that contains 8 column headers that are dynamic and will be constantly be changing.
The content in the column will always be the same "Pass" or "Fail". I want to get the percent pass rate for a column and append it to the bottom. What I have so far is:

 ...| appendpipe [ stats count(*="Passed") as *_pass, count(*) as total_* | eval *=round(*_pass*100/total_*,2)]

I know the eval statement won't work because the wildcard will be considered multiplication.
Also the count(*="Passed") line will not evaluate without errors.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

dgadjov
Explorer

The replace "failed" with 0 and "Passed" with 100 is what I needed. After that I can just use the average function and revert the numbers back to pass fail.

0 Karma

dgadjov
Explorer

This almost works. There is one thing I forgot to mention. Sometimes the cell maybe empty. The scale function is applying scale on all column based off the one scalar value. Since each column has a different count the percent in columns with an empty cell are wrong.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...