How do I add the total count of all events in each row ?

[Ombessam]

Here is what I have

Now I want to add a new column like this eval nullPercent = round((nullCount/total)*100, 2) where total is the total count of all events.

For that I tried first to append total like this

Unfortunately total is only appended in the first row therefore I'm not able to calculate nullPercent.

Can someone help me achieve my goal ? 

[richgalloway · Accepted solution]

The appendcols command is almost always the wrong answer to a SPL problem.  There are too many considerations for it to be as useful as one might expect.

In this case, try using eventstats to calculate the total.  Then you can use eval to get the percentage for each value.

...
| eventstats sum(nullCount) as total
| eval nullPercent=round((nullCount * 100)/total,2)

P.S. Please put SPL in a code block rather than in an image.  That makes it easier for us to test your code and our responses.

[Ombessam]

Thanks @richgalloway  you're right. It worked

index=main source="employees_data.csv" 
| fields - source* sourcetype* splunk* eventtype tag* index* linecount* punct* timestamp* _time _raw
| foreach * 
    [ eval <<FIELD>>_isNull = if(isnull('<<FIELD>>'), 1, 0) ]
| stats sum(*_isNull) as *
| transpose column_name="missing_logs"
| rename "row 1" as nullCount
| eventstats sum(nullCount) as total_events
| eval nullPercent = round((nullCount / total_events) * 100, 2)
| fields - total_events
| where nullCount > 0 
| rename nullCount as "Total Missing", nullPercent as "Missing Percentage", missing_logs as "Missing Logs"

[Ombessam]

@richgalloway  thanks for your answer.

But I want to calculate nullPercent based on total_events (Total count of all events) not based on total count of nulls (| eventstats sum(nullCount) as total)

[thahir]

@Ombessam you need total number of null events across overall?

like below