Splunk Search

How to Calculate the Percentage of each entry

Sentira
Explorer

I have the following SPL and I want to show table below. The value of Total must be equal to count of events (1588).  How can I pur the total count of events into Total variable?

index=abc 
| stats count as Count by reason_code
| where reason_code != "false"
| addtotals col=t labelfield=reason_code label="Retrieval task cancelled" fieldname="Percentage"
| eval "Percentage"= round((Count/Total) * 100,2)."%"

image.png

Labels (5)
Tags (1)
0 Karma
1 Solution

isoutamo
SplunkTrust
SplunkTrust

Hi

Did this help you?

index=abc 
| stats count as Count by reason_code
| eventstats sum(Count) as Total 
| where reason_code != "false"
| addtotals col=t labelfield=reason_code label="Retrieval task cancelled" fieldname="Percentage"
| eval "Percentage"= round((Count/Total) * 100,2)."%"

r. Ismo 

View solution in original post

isoutamo
SplunkTrust
SplunkTrust

Hi

Did this help you?

index=abc 
| stats count as Count by reason_code
| eventstats sum(Count) as Total 
| where reason_code != "false"
| addtotals col=t labelfield=reason_code label="Retrieval task cancelled" fieldname="Percentage"
| eval "Percentage"= round((Count/Total) * 100,2)."%"

r. Ismo 

Sentira
Explorer

Hi Ismo,

your solution works. Thanks! 🙂

 

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...