Splunk Search

Get % values out of a query

angersleek
Path Finder

I have the following query. The key TEST_DECISION has 4x possible outcomes. CALL_FAILED, VALID, INVALID, NOT_CALLED.

ns=test* TEST_DECISION
PRODUCT IN (SAMPLE_123)
| timechart span=5m limit=0 count by TEST_DECISION

The output is as follows:

_time                             CALL_FAILED                 VALID             INVALID NOT_CALLED
2020-04-14T05:50:00.000-0700       11                           83                   7                  46
2020-04-14T05:55:00.000-0700       6                            60                   6                  42
2020-04-14T06:00:00.000-0700       8                            78                   19                 55
2020-04-14T06:05:00.000-0700       11                           86                   19                 59
2020-04-14T06:10:00.000-0700       10                           94                    17                    71
2020-04-14T06:15:00.000-0700       8                            67                    17                    63
2020-04-14T06:20:00.000-0700       2                            19                     4                    17

Is there a way I could show % instead? I only care about VALID and INVALID.
Thus I want to get the following instead.

For first row 100% will be 83(valid) + 7(invalid)

Thus I want to achieve following

VALID    INVALID
92.22%  7.77%

Please advice if there is a way I could achieve this. Thank you.

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total
Get Updates on the Splunk Community!

Data Management Digest – December 2025

Welcome to the December edition of Data Management Digest! As we continue our journey of data innovation, the ...

Index This | What is broken 80% of the time by February?

December 2025 Edition   Hayyy Splunk Education Enthusiasts and the Eternally Curious!    We’re back with this ...

Unlock Faster Time-to-Value on Edge and Ingest Processor with New SPL2 Pipeline ...

Hello Splunk Community,   We're thrilled to share an exciting update that will help you manage your data more ...