Splunk Search

How to calculate average and percentage for fields with only names?

ranjitbrhm1
Communicator

Good Day splunkers. I have a query where i want to calculate the number of times a name came on the field, the average times the name was used and the percentage of the name in the field. (The below is truncated for understanding)

splunkd 12,786  1.1%    
Apache#1    12,094  1.041%  
splunk-perfmon  11,788  1.015%  
java#3  11,684  1.006%  
rotatelogs  11,452  0.986%  
svchost#4   11,409  0.982%  
perl    11,078  0.954%  
emagent 10,821  0.931%  
Tomcat7 10,309  0.887%  
splunk-regmon   10,274  0.884%  

If the field values were numeric I could have counted and summed and created the avg. but when the field value names like above how do I go forward? I have done something similar once with eval but I can't seem to figure this out.
Thanks

0 Karma
1 Solution

TISKAR
Builder

Can you try this please:

<YourBaseSearch>| stats count by name | eventstats sum(count)  as tot | eval pers=round(100*count/tot,2).%

For avg you want calcul the avg by what?

View solution in original post

TISKAR
Builder

Can you try this please:

<YourBaseSearch>| stats count by name | eventstats sum(count)  as tot | eval pers=round(100*count/tot,2).%

For avg you want calcul the avg by what?

akarivaratharaj
Communicator

How to find out count and average of a text based field for every 1 minute of time span

0 Karma

FrankVl
Ultra Champion

Try something like this:

...your search here...
| eventstats count as namecount by name
| eventstats count as totalcount
| eval percentage=(namecount/totalcount)*100
| fieldformat percentage=percentage."%"
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...