Are you a member of the Splunk Community?
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- Getting a percentage value to show up in a statist...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have this query
earliest=-6w@w1 index=top10 source=/home/oracle/workdir/account_log.csv STATUS="Reason*"|transaction PREMISE maxspan>19d|eventstats count as grandtotal|eventstats count as ptotal by STATUS|chart sparkline(count) as Trend count(STATUS) as Count values(eval(round(ptotal/grandtotal*100,2))) as Percentage by STATUS | sort -Count
And everything works except for the Percentage near the end. I get multiple values in the Percentage column where the Trend and Count columns are just fine
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
earliest=-6w@w1 index=top10 source=/home/oracle/workdir/account_log.csv STATUS="Reason*"
| transaction PREMISE maxspan>19d
| eventstats count as grandtotal
| chart sparkline(count) as Trend count(STATUS) as Count max(grandtotal) as gtotal count as ptotal by STATUS
| eval Percentage=round(ptotal/gtotal*100, 2)
| sort -Count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Try this
earliest=-6w@w1 index=top10 source=/home/oracle/workdir/account_log.csv STATUS="Reason*"
| transaction PREMISE maxspan>19d
| eventstats count as grandtotal
| chart sparkline(count) as Trend count(STATUS) as Count max(grandtotal) as gtotal count as ptotal by STATUS
| eval Percentage=round(ptotal/gtotal*100, 2)
| sort -Count
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
That worked perfectly!!!! Thanks Sundareshr!!!!
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Looks like this
Trend Count Percentage
(sparkline is here) 2791 0.05
0.15
0.25
0.41
0.82
Take Action Automatically on Splunk Alerts with Red Hat Ansible Automation Platform
Calling All Security Pros: Ready to Race Through Boston?
Beyond Detection: How Splunk and Cisco Integrated Security Platforms Transform ...
