Splunk Search

Get % values out of a query

angersleek
Path Finder

I have the following query. The key TEST_DECISION has 4x possible outcomes. CALL_FAILED, VALID, INVALID, NOT_CALLED.

ns=test* TEST_DECISION
PRODUCT IN (SAMPLE_123)
| timechart span=5m limit=0 count by TEST_DECISION

The output is as follows:

_time                             CALL_FAILED                 VALID             INVALID NOT_CALLED
2020-04-14T05:50:00.000-0700       11                           83                   7                  46
2020-04-14T05:55:00.000-0700       6                            60                   6                  42
2020-04-14T06:00:00.000-0700       8                            78                   19                 55
2020-04-14T06:05:00.000-0700       11                           86                   19                 59
2020-04-14T06:10:00.000-0700       10                           94                    17                    71
2020-04-14T06:15:00.000-0700       8                            67                    17                    63
2020-04-14T06:20:00.000-0700       2                            19                     4                    17

Is there a way I could show % instead? I only care about VALID and INVALID.
Thus I want to get the following instead.

For first row 100% will be 83(valid) + 7(invalid)

Thus I want to achieve following

VALID    INVALID
92.22%  7.77%

Please advice if there is a way I could achieve this. Thank you.

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...