Splunk Search

How do I search for a Term, then get the Percentage out of Total?

mkarimi
Path Finder

I'm writing a search query that needs to look for a specific word SPECIFIC_WORD in the logs of host HOST_X and then determine how many times that searched term comes up when compared to overall. Looking for something along the lines of:

1) search: host='HOST_X' => it will yield to say 100 results
2) search: host='HOST_X' "SPECIFC_WORD" => it will yield to say 20 results
3) do a percentage out of total => 20%
4) be able to do the best graph by date_hour of step_2/step_1

I've done something like that already:

host="HOST_X" | stats count as total by date_hour | join [search host="HOST_X" "SPECIFIC_WORD" | stats count as something by date_hour] | eval percent_out_of=(something/total)*100

That seems to give me what I'm looking for, but only see total in the graph. It could be that the total number is just too large, but I'm not sure)

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Actually, you should be able to do this without a join.

host="HOST_X" | eval does_match = if(searchmatch("SPECIFIC_WORD"),1,0) | stats sum(does_match) as Specific_Word count as Total by date_hour | eval percent_out_of = (Specific_Word/count)*100

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Actually, you should be able to do this without a join.

host="HOST_X" | eval does_match = if(searchmatch("SPECIFIC_WORD"),1,0) | stats sum(does_match) as Specific_Word count as Total by date_hour | eval percent_out_of = (Specific_Word/count)*100

mkarimi
Path Finder

thanks for the help. Is it possible to show them both in the same time vs count column graph? I know I can change the graph type but it shows them next to each other in the column graph instead of the same column.

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...