Splunk Search

How to calcaulate a percentage based on the number of days, which are over 2 days old?

Sfry1981
Communicator

I have a bunch of values for number of days but I want to write a query that shows the percentage of results that are over 2 days old. I have posted an example below

number of days
1
3
5
6
2

Currently I have Base search | eval percentage = if((days> 2), 1, 0) so this gives me a columns of 1's and 0's but how can I say 0's have this much percentage and 1's have this much percentage based on the joint total of 100%?

Thanks

0 Karma
1 Solution

somesoni2
Revered Legend

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

View solution in original post

somesoni2
Revered Legend

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

Sfry1981
Communicator

Thanks @somesoni2. I have been testing and found that it does not come to a full 100% so if i change the search too Base search | eval gt2= if((days< 3), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) then it shows only 54% so its missing about 8% on the figure. When i do my search as Base search | eval gt2= if((days< 1000), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) it shows as 91.67%. Do you kn ow what the issue is?

0 Karma

Sfry1981
Communicator

Ignore me @somesoni2 as there were a couple of values missing in the columns so all correct

0 Karma
Get Updates on the Splunk Community!

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

🔐 Trust at Every Hop: How mTLS in Splunk Enterprise 10.0 Makes Security Simpler

From Idea to Implementation: Why Splunk Built mTLS into Splunk Enterprise 10.0  mTLS wasn’t just a checkbox ...