Splunk Search

How to calculate average and percentage for fields with only names?

ranjitbrhm1
Communicator

Good Day splunkers. I have a query where i want to calculate the number of times a name came on the field, the average times the name was used and the percentage of the name in the field. (The below is truncated for understanding)

splunkd 12,786  1.1%    
Apache#1    12,094  1.041%  
splunk-perfmon  11,788  1.015%  
java#3  11,684  1.006%  
rotatelogs  11,452  0.986%  
svchost#4   11,409  0.982%  
perl    11,078  0.954%  
emagent 10,821  0.931%  
Tomcat7 10,309  0.887%  
splunk-regmon   10,274  0.884%  

If the field values were numeric I could have counted and summed and created the avg. but when the field value names like above how do I go forward? I have done something similar once with eval but I can't seem to figure this out.
Thanks

0 Karma
1 Solution

TISKAR
Builder

Can you try this please:

<YourBaseSearch>| stats count by name | eventstats sum(count)  as tot | eval pers=round(100*count/tot,2).%

For avg you want calcul the avg by what?

View solution in original post

TISKAR
Builder

Can you try this please:

<YourBaseSearch>| stats count by name | eventstats sum(count)  as tot | eval pers=round(100*count/tot,2).%

For avg you want calcul the avg by what?

akarivaratharaj
Communicator

How to find out count and average of a text based field for every 1 minute of time span

0 Karma

FrankVl
Ultra Champion

Try something like this:

...your search here...
| eventstats count as namecount by name
| eventstats count as totalcount
| eval percentage=(namecount/totalcount)*100
| fieldformat percentage=percentage."%"
Get Updates on the Splunk Community!

Observe and Secure All Apps with Splunk

  Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

Splunk Decoded: Business Transactions vs Business IQ

It’s the morning of Black Friday, and your e-commerce site is handling 10x normal traffic. Orders are flowing, ...

Fastest way to demo Observability

I’ve been having a lot of fun learning about Kubernetes and Observability. I set myself an interesting ...