Splunk Search

How to calcaulate a percentage based on the number of days, which are over 2 days old?

Sfry1981
Communicator

I have a bunch of values for number of days but I want to write a query that shows the percentage of results that are over 2 days old. I have posted an example below

number of days
1
3
5
6
2

Currently I have Base search | eval percentage = if((days> 2), 1, 0) so this gives me a columns of 1's and 0's but how can I say 0's have this much percentage and 1's have this much percentage based on the joint total of 100%?

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

View solution in original post

somesoni2
Revered Legend

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

Sfry1981
Communicator

Thanks @somesoni2. I have been testing and found that it does not come to a full 100% so if i change the search too Base search | eval gt2= if((days< 3), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) then it shows only 54% so its missing about 8% on the figure. When i do my search as Base search | eval gt2= if((days< 1000), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) it shows as 91.67%. Do you kn ow what the issue is?

0 Karma

Sfry1981
Communicator

Ignore me @somesoni2 as there were a couple of values missing in the columns so all correct

0 Karma
Get Updates on the Splunk Community!

Splunk Decoded: Service Maps vs Service Analyzer Tree View vs Flow Maps

It’s Monday morning, and your phone is buzzing with alert escalations – your customer-facing portal is running ...

What’s New in Splunk Observability – September 2025

What's NewWe are excited to announce the latest enhancements to Splunk Observability, designed to help ITOps ...

Fun with Regular Expression - multiples of nine

Fun with Regular Expression - multiples of nineThis challenge was first posted on Slack #regex channel ...