Splunk Search

Display table along with percentage

ncbshiva
Communicator

Hi

I need to display table along with percentage

This is my search query : source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | chart count over DS_CLIENTE by DS_STATUS_TRIAGEM

This is my table

DS_CLIENTE Aprovado Garantia Reparo Sucata
Contractor1 11509 1882 21651 323
Contractor2 1 0 5 0

I need to display the same table along with percentage.
This is just example
DS_CLIENTE Aprovado Garantia Reparo Sucata
Contractor1 11509(65.98) 1882(32.86) 21651(94.34) 323(29.65)
Contractor2 1 0 5 0

Please help me in this.

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this

source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | stats count by DS_CLIENTE, DS_STATUS_TRIAGEM | eventstats sum(count) as Total by DS_CLIENTE| eval count=count."(".round(count*100/Total,2)."%)"| chart first(count) as count over DS_CLIENTE by DS_STATUS_TRIAGEM| fillnull value="0(0.00%)"

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try this

source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | stats count by DS_CLIENTE, DS_STATUS_TRIAGEM | eventstats sum(count) as Total by DS_CLIENTE| eval count=count."(".round(count*100/Total,2)."%)"| chart first(count) as count over DS_CLIENTE by DS_STATUS_TRIAGEM| fillnull value="0(0.00%)"

ncbshiva
Communicator

yes 100% for each contractor

0 Karma

somesoni2
SplunkTrust
SplunkTrust

How is the percentage calculated, 100% for each contractor?

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...

We’ve Got Education Validation!

Are you feeling it? All the career-boosting benefits of up-skilling with Splunk? It’s not just a feeling, it's ...