Splunk Search

Get % values out of a query

angersleek
Path Finder

I have the following query. The key TEST_DECISION has 4x possible outcomes. CALL_FAILED, VALID, INVALID, NOT_CALLED.

ns=test* TEST_DECISION
PRODUCT IN (SAMPLE_123)
| timechart span=5m limit=0 count by TEST_DECISION

The output is as follows:

_time                             CALL_FAILED                 VALID             INVALID NOT_CALLED
2020-04-14T05:50:00.000-0700       11                           83                   7                  46
2020-04-14T05:55:00.000-0700       6                            60                   6                  42
2020-04-14T06:00:00.000-0700       8                            78                   19                 55
2020-04-14T06:05:00.000-0700       11                           86                   19                 59
2020-04-14T06:10:00.000-0700       10                           94                    17                    71
2020-04-14T06:15:00.000-0700       8                            67                    17                    63
2020-04-14T06:20:00.000-0700       2                            19                     4                    17

Is there a way I could show % instead? I only care about VALID and INVALID.
Thus I want to get the following instead.

For first row 100% will be 83(valid) + 7(invalid)

Thus I want to achieve following

VALID    INVALID
92.22%  7.77%

Please advice if there is a way I could achieve this. Thank you.

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total
Get Updates on the Splunk Community!

Splunk Enterprise Security: Your Command Center for PCI DSS Compliance

Every security professional knows the drill. The PCI DSS audit is approaching, and suddenly everyone's asking ...

Developer Spotlight with Guilhem Marchand

From Splunk Engineer to Founder: The Journey Behind TrackMe    After spending over 12 years working full time ...

Cisco Catalyst Center Meets Splunk ITSI: From 'Payments Are Down' to Root Cause in ...

The Problem: When Networks and Services Don't Talk Payment systems fail at a retail location. Customers are ...