Splunk Search

How do you get multiple percentage results in one table?

stephenmeyers
Explorer

I would like to report the total number games played per team, and the percentage of wins, losses, and ties by team. Example data:

team=A result=win
team=A result=loss
team=B result=win
team=B result=win
team=B result=tie
team=A result=loss
team=B result=win

Desired Splunk output:

Team    Games Played    Win %    Loss %    Tie %
A       3               33%      66%       0%
B       4               75%      0%        25%
Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi @stephenmeyers

Try this, considered column name asTeam,Result in index

your query...| stats count as played, count(eval(Result=="win")) as win,count(eval(Result=="loss")) as loss,count(eval(Result=="tie")) as tie by Team 
| eval loss=round(loss/played*100,2)."%", win=round(win/played*100,2)."%", tie=round(tie/played*100,2)."%" 
| rename played as "Game Played", win as "Win%", loss as "Loss%", tie as "Tie%"

alt text

View solution in original post

vnravikumar
Champion

Hi @stephenmeyers

Try this, considered column name asTeam,Result in index

your query...| stats count as played, count(eval(Result=="win")) as win,count(eval(Result=="loss")) as loss,count(eval(Result=="tie")) as tie by Team 
| eval loss=round(loss/played*100,2)."%", win=round(win/played*100,2)."%", tie=round(tie/played*100,2)."%" 
| rename played as "Game Played", win as "Win%", loss as "Loss%", tie as "Tie%"

alt text

Get Updates on the Splunk Community!

[Puzzles] Solve, Learn, Repeat: Character substitutions with Regular Expressions

This challenge was first posted on Slack #puzzles channelFor BORE at .conf23, we had a puzzle question which ...

Shape the Future of Splunk: Join the Product Research Lab!

Join the Splunk Product Research Lab and connect with us in the Slack channel #product-research-lab to get ...

Auto-Injector for Everything Else: Making OpenTelemetry Truly Universal

You might have seen Splunk’s recent announcement about donating the OpenTelemetry Injector to the ...