How do I present my search results as a percentage instead of a count?

[splunkids75]

Hi everybody!

My database has to many properties, but important properties to set in my Dashboard starting with "U" (U12A8_TARGETOBJECTSTORENAME, U1708_DOCUMENTTITLE, U1903_ARCHIVALDATE, U2A76_CMSEARCHSCHEMAVERSION, U2D52_ICNAUTORUN, U2E68_ICNCLASSNAME, U3975_TARGETOBJECTCLASSID............)

Currently in my Splunk dashboard, I created a "Bar Panel".

My search is:

* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE"

My result is perfect, but I prefer to have my result as a percentage, so I want to replace "Count" by "Percentage"...

So I have to replace count by total like:

 percentage = ("U*" * 100) / TOTAL but I don't know how to do that with the "U*"

I define TOTAL like this:

* | stats count(U*) as U*, count(U1708_DOCUMENTTITLE) as TOTAL | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE"

Do you know how I can do that?

Thanx a lot for answers!

[somesoni2 · Accepted solution]

Try this search

* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage

[splunkids75]

Hi Somesoni2

Thanx for your answer! That work fine but I have a little bug with the result, I search to correct it :
Splunk say that total is 1096 but it's 1068.

Thanx again!

[sundareshr]

Add this to the end

... | eval perc=tostring(round((Count*100)/Total, 2), "commas")."%"

[splunkids75]

Hi Sundareshr!

Thanx for your answer!