Splunk Search

Count Occurrences of a string in all columns dynamically

dgadjov
Explorer

The goal is just to have the percentage pass rate at the bottom of a dynamically named column that contains "Passed" or "Failed"

I have a table that contains 8 column headers that are dynamic and will be constantly be changing.
The content in the column will always be the same "Pass" or "Fail". I want to get the percent pass rate for a column and append it to the bottom. What I have so far is:

 ...| appendpipe [ stats count(*="Passed") as *_pass, count(*) as total_* | eval *=round(*_pass*100/total_*,2)]

I know the eval statement won't work because the wildcard will be considered multiplication.
Also the count(*="Passed") line will not evaluate without errors.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

dgadjov
Explorer

The replace "failed" with 0 and "Passed" with 100 is what I needed. After that I can just use the average function and revert the numbers back to pass fail.

0 Karma

dgadjov
Explorer

This almost works. There is one thing I forgot to mention. Sometimes the cell maybe empty. The scale function is applying scale on all column based off the one scalar value. Since each column has a different count the percent in columns with an empty cell are wrong.

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...