Splunk Search

How to Count string matches in event record and calculate percentage?

C37996518
Explorer

 

 

I have a log that documents call results for phone calls as a CSV event record
There is a field in the event record for the phone number
The event record may contain a list of sub-events that I want to track.
If the CSV event record contains a sting "MOCK,?,?,1" that is counted as a BAD call. The "1" is what determine it's a bad call we don't care what the ? number are)
If the event record has any event ("MOCK,?,?,0" but not "MOCK,?,?,1") this is a Good call

A would like to report to show the number of calls to  every  "phone number" and the percentage of Bad calls

Labels (3)
Tags (4)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Assuming you have already extracted your fields and field1 ("MOCK") is the number and field4 ("0" or "1"), then you can try this

| stats count count(eval(field4=="1")) as bad by field1
| eval percent=100*bad/count
0 Karma

C37996518
Explorer

Thanks but I have not extacted the (Mock?,?,x) as a field. This issue is the MOCK string can occur zero or many times in a call.

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

As you can see, without an accurate picture of the events you have and what fields you already have extract, I can only guess at possible solutions.

What is it you want help with? Is it the extraction of data into fields, or the type of search you need to count and work out percentages, or, how to filter out the events you don't need to count, or how to correlate events by "number"?

Perhaps if you could share some de-sensitised events and what you have already tried, we might be able to help you progress?

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...