Splunk Search

How to add percentages to all the fields?

inkedia
Explorer

 

| lookup local=true ipasncidr_def CIDR as dest_ip output Organization
| lookup src_eonid_name.csv SRC_EONID OUTPUT "SRC_EONID NAME"
| top limit=3 "SRC_EONID NAME", dest_ip, dest_port, servicenow, Organization by SRC_EONID
| stats values(dest_ip) as "Destination" dc(dest_ip) as "Destination IP count" values(Organization) as "Organization" values(dest_port) as "Dest Ports" values(servicenow) as "Service now Tickets" by "SRC_EONID NAME" SRC_EONID

 



Hi everyone.
So I have this query that is being saved as dashboard(statistical table.). Is there a way I can include percentages for all the fields captured in the statistical table. 

 

 

Labels (3)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

It looks like you only have 1 numerical field in your output - dc(dest_ip). What would the percentage show that you want and what do you want the percentage to show for the other fields, e.g. Service now Tickets?

 

0 Karma

inkedia
Explorer

This is what I'm trying to achieve 



SRC_EON NAME

SRC_EON

Dest IP

Organization

Service now ticket

Dest port

ABA

3311

*********    88.94%

*********      5.12%
*********        3.32%
others

Google
Microsoft

TASK132325   80%

 

 

449         100%

0 Karma
Get Updates on the Splunk Community!

Unlock New Opportunities with Splunk Education: Explore Our Latest Courses!

At Splunk Education, we’re dedicated to providing top-tier learning experiences that cater to every skill ...

Technical Workshop Series: Splunk Data Management and SPL2 | Register here!

Hey, Splunk Community! Ready to take your data management skills to the next level? Join us for a 3-part ...

Spotting Financial Fraud in the Haystack: A Guide to Behavioral Analytics with Splunk

In today's digital financial ecosystem, security teams face an unprecedented challenge. The sheer volume of ...