Splunk Search

How do I search for a Term, then get the Percentage out of Total?

mkarimi
Path Finder

I'm writing a search query that needs to look for a specific word SPECIFIC_WORD in the logs of host HOST_X and then determine how many times that searched term comes up when compared to overall. Looking for something along the lines of:

1) search: host='HOST_X' => it will yield to say 100 results
2) search: host='HOST_X' "SPECIFC_WORD" => it will yield to say 20 results
3) do a percentage out of total => 20%
4) be able to do the best graph by date_hour of step_2/step_1

I've done something like that already:

host="HOST_X" | stats count as total by date_hour | join [search host="HOST_X" "SPECIFIC_WORD" | stats count as something by date_hour] | eval percent_out_of=(something/total)*100

That seems to give me what I'm looking for, but only see total in the graph. It could be that the total number is just too large, but I'm not sure)

0 Karma
1 Solution

alacercogitatus
SplunkTrust
SplunkTrust

Actually, you should be able to do this without a join.

host="HOST_X" | eval does_match = if(searchmatch("SPECIFIC_WORD"),1,0) | stats sum(does_match) as Specific_Word count as Total by date_hour | eval percent_out_of = (Specific_Word/count)*100

View solution in original post

alacercogitatus
SplunkTrust
SplunkTrust

Actually, you should be able to do this without a join.

host="HOST_X" | eval does_match = if(searchmatch("SPECIFIC_WORD"),1,0) | stats sum(does_match) as Specific_Word count as Total by date_hour | eval percent_out_of = (Specific_Word/count)*100

mkarimi
Path Finder

thanks for the help. Is it possible to show them both in the same time vs count column graph? I know I can change the graph type but it shows them next to each other in the column graph instead of the same column.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...