Splunk Search

How do I create splunk query to get the total percentage of the two results

rodrigrc
Explorer

I'm new to splunk and need further guidance to be able to accomplish my dashboard for Pi-Hole:

Could some expert guide me how?

Queries Blocked
tag=dns tag=network tag=resolution query_type=blocked |stats count

Total Queries
sourcetype="pihole:log*" tag=dns tag=network tag=resolution query |stats count

How do I create splunk query to get the total percentage of the two results
Queries Blocked/Total queries x 100 = ?

I just need the exact value so i can just simply copy and paste the good answer here to my splunk field.

Your input is highly appreciated.

Tags (1)
0 Karma

nickhills
Ultra Champion

Try this:

sourcetype="pihole:log*"  tag=dns tag=network tag=resolution 
|stats count as total, count(eval(query_type="blocked") as blocked 
|eval percent=round((blocked/total)* 100,1)
If my comment helps, please give it a thumbs up!
0 Karma

rodrigrc
Explorer

if i put this search query, i get the correct total no output, but with "zero" blocked output.
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
sourcetype="pihole:log" tag=dns tag=network tag=resolution message_type="Query"
|stats count as total, count(eval(query_type="Blocked")) as blocked
|eval percent=round((blocked/total)* 100,1)

total blocked percent
20433 0 0.0
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

And below results shows the correct no. of blocked outputs, but too many entries outputs
+++++++++++++++++++++++++++++++++++++++++++++++++++++++++++
sourcetype="pihole:log" tag=dns tag=network tag=resolution
|stats count as total, count(eval(query_type="Blocked")) as blocked
|eval percent=round((blocked/total)* 100,1)

total blocked percent
91921 3683 4.0
++++++++++++++++++++++++++++++++++++++++++++++++++++++++++

0 Karma

to4kawa
Ultra Champion

message_type="Query" does not have query_type="Blocked"
and many message_type have query_type="Blocked"
you only know your logs. good luck.

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...