Splunk Search

Count Occurrences of a string in all columns dynamically

dgadjov
Explorer

The goal is just to have the percentage pass rate at the bottom of a dynamically named column that contains "Passed" or "Failed"

I have a table that contains 8 column headers that are dynamic and will be constantly be changing.
The content in the column will always be the same "Pass" or "Fail". I want to get the percent pass rate for a column and append it to the bottom. What I have so far is:

 ...| appendpipe [ stats count(*="Passed") as *_pass, count(*) as total_* | eval *=round(*_pass*100/total_*,2)]

I know the eval statement won't work because the wildcard will be considered multiplication.
Also the count(*="Passed") line will not evaluate without errors.

Tags (1)
0 Karma
1 Solution

martin_mueller
SplunkTrust
SplunkTrust

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

View solution in original post

martin_mueller
SplunkTrust
SplunkTrust

Give this a try:

... | replace "Fail" with 0 "Pass" with 100 | appendpipe [stats sum(*) as *, count] | scale field=count pattern=. round=2 | replace 0 with "Fail" 100 with "Pass" | fields - count

Requires the http://splunk-base.splunk.com/apps/76026/scale-command to get the percentages for arbitrarily named columns right.

dgadjov
Explorer

The replace "failed" with 0 and "Passed" with 100 is what I needed. After that I can just use the average function and revert the numbers back to pass fail.

0 Karma

dgadjov
Explorer

This almost works. There is one thing I forgot to mention. Sometimes the cell maybe empty. The scale function is applying scale on all column based off the one scalar value. Since each column has a different count the percent in columns with an empty cell are wrong.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...