Splunk Search

How can I turn a single value number into a percentage?

jhilton90
Path Finder

So I'm trying to turn a single value number into a percentage but the code just returns a number still.

Here's my code

index="keycloak" "MFA" 
mfa="MFA code issued" OR (mfa="MFA challenge issued")
| stats count AS Total count(eval(mfa="MFA code issued")) AS MFA_code_issued
| eval Percentage=round(((MFA_code_issued/Total)*100),2)
| table MFA_code_issued Percentage

Just to give some context:

MFA challenge issued = The number of challenges issued to customers to ask them whether they want to receive a OTP code via SMS or Email
MFA code issued = The number of OTP codes that have actually been issued to customers

So my colleagues have asked for the percentage of MFA codes issued

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index="keycloak" "MFA" 
mfa="MFA code issued" OR (mfa="MFA challenge issued")
| stats count(eval(mfa="MFA code issued")) AS MFA_code_issued count(eval(mfa="MFA challenge issued")) AS MFA_challenge_issued
| eval Percentage=((MFA_code_issued/MFA_challenge_issued)*100)
| eval Percentage=round('Percentage', 2)." %"

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust

A percentage is a number, it represents the number of times out of 100 that the thing being counted has occurred out of the total.

Having said that, your total calculation will include the "MFA challenge issued" events as well as the "MFA code issued" events, so if you always issue a challenge and only sometimes issue a code, your percentage is always going to be less than 50%. Perhaps you should be counting the challenges and the codes and determining the percentage of challenges that a code is issued for?

0 Karma

jhilton90
Path Finder

So I should have been a bit clearer with this, that's my fault

So I want to find the percentage of MFA code issued compared to the number of MFA challenges issued. For example if 1000 MFA challenges have been issued and then 750 MFA codes have been issued then I know that 75% of people have chosen to receive an MFA code instead of abandoning the journey.

So I updated my query to this

index="keycloak" "MFA" 
mfa="MFA code issued" OR (mfa="MFA challenge issued")
| stats count AS Total count(eval(mfa="MFA code issued")) AS MFA_code_issued
| stats count AS Total count(eval(mfa="MFA challenge issued")) AS MFA_challenge_issued
| eval Percentage=((MFA_code_issued/MFA_challenge_issued)*100)
| eval Percentage=round('Percentage', 2)." %"
| stats count

However, that now returns a value of 1

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust
index="keycloak" "MFA" 
mfa="MFA code issued" OR (mfa="MFA challenge issued")
| stats count(eval(mfa="MFA code issued")) AS MFA_code_issued count(eval(mfa="MFA challenge issued")) AS MFA_challenge_issued
| eval Percentage=((MFA_code_issued/MFA_challenge_issued)*100)
| eval Percentage=round('Percentage', 2)." %"

jhilton90
Path Finder

Sorry I marked as the solution by accident. I tried your code but it just returns the number as if you were just using a stats count query

0 Karma

PickleRick
SplunkTrust
SplunkTrust

But @ITWhisperer 's solution should do precisely what you described - count number of requests, count number of issued MFAs and calculate percentage.

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

you search should retuning a number that's the percentage you're calculating.

What's the problem, maybe do you need to have the "%" char after the number?

if this is your need, you can use

index="keycloak" "MFA" 
mfa="MFA code issued" OR (mfa="MFA challenge issued")
| stats count AS Total count(eval(mfa="MFA code issued")) AS MFA_code_issued
| eval Percentage=round(((MFA_code_issued/Total)*100),2)." %"
| table MFA_code_issued Percentage

Or if you're using a Single Value Panel, you can add the perc to the panel.

If instead you mean something else, please describe your need with other details.

Ciao.

Giuseppe

0 Karma

jhilton90
Path Finder

Nevermind ive sorted it! 🙂

0 Karma

jhilton90
Path Finder

How would I add the percentage as a single value?

0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @jhilton90,

you have to modify your search putting in table only the Percentage field and then save it as a Dashboard Single Value Panel.

In this case, you don't need to add "%" to the output but you can put it in the panel.

Ciao.

Giuseppe

0 Karma
Get Updates on the Splunk Community!

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...