Splunk Search

How to calcaulate a percentage based on the number of days, which are over 2 days old?

Sfry1981
Communicator

I have a bunch of values for number of days but I want to write a query that shows the percentage of results that are over 2 days old. I have posted an example below

number of days
1
3
5
6
2

Currently I have Base search | eval percentage = if((days> 2), 1, 0) so this gives me a columns of 1's and 0's but how can I say 0's have this much percentage and 1's have this much percentage based on the joint total of 100%?

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

View solution in original post

somesoni2
Revered Legend

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

Sfry1981
Communicator

Thanks @somesoni2. I have been testing and found that it does not come to a full 100% so if i change the search too Base search | eval gt2= if((days< 3), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) then it shows only 54% so its missing about 8% on the figure. When i do my search as Base search | eval gt2= if((days< 1000), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) it shows as 91.67%. Do you kn ow what the issue is?

0 Karma

Sfry1981
Communicator

Ignore me @somesoni2 as there were a couple of values missing in the columns so all correct

0 Karma
Get Updates on the Splunk Community!

What’s New & Next in Splunk SOAR

Security teams today are dealing with more alerts, more tools, and more pressure than ever.  Join us on ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

September Community Champions: A Shoutout to Our Contributors!

As we close the books on another fantastic month, we want to take a moment to celebrate the people who are the ...