Splunk Search

## How to calculate count and percentage of fields?

Motivator

hi

need to calculate count and percentage of fields.

orginal post here, the main issue is fields contain space or balnk (2 single quotation

i have spl like below,

| eventstats count as namecount by name
| eventstats count as colorcount by color
| eventstats count as statuscount by status
| eventstats count(name) as nametotal
| eventstats count(color) as colortotal
| eventstats count(status) as statustotal
| eval name=printf("%04u %s %d", 10000-namecount, name, nametotal)
| eval color=printf("%04u %s %d", 10000-colorcount, color, colortotal)
| eval status=printf("%04u %s %d", 10000-statuscount, status, statustotal)
| stats values(name) as name values(color) as color values(status) as status
| eval cname=mvmap(name,10000-tonumber(mvindex(split(name," "),0)))
| eval ccolor=mvmap(color,10000-tonumber(mvindex(split(color," "),0)))
| eval cstatus=mvmap(status,10000-tonumber(mvindex(split(status," "),0)))
| eval pname=mvmap(name,100*(10000-tonumber(mvindex(split(name," "),0)))/tonumber(mvindex(split(name," "),2)))
| eval pcolor=mvmap(color,100*(10000-tonumber(mvindex(split(color," "),0)))/tonumber(mvindex(split(color," "),2)))
| eval pstatus=mvmap(status,100*(10000-tonumber(mvindex(split(status," "),0)))/tonumber(mvindex(split(status," "),2)))
| eval name=mvmap(name,mvindex(split(name," "),1))
| eval color=mvmap(color,mvindex(split(color," "),1))
| eval status=mvmap(status,mvindex(split(status," "),1))
| fields name cname pname color ccolor pcolor status cstatus pstatus

i have some "date" or "color" like this: 'Mon May 30 00:00:00 USDT 2022' or ''

FYI: some of them contain space between Single quotation like this 'Mon May 30 00:00:00 USDT 2022', some of them are empty just has Single quotation like this ''

not show them correcty and won't calculate percentage of them.

current output:

Date cDate %Date Color cColor %Color

'Mon         2                              ''           1

'Today'    1           33.0     'red'        2         66.0

expected output:

Date                                                                           cDate %Date           Color cColor %Color

'Mon May 30 00:00:00 USDT 2022'         2         66.66                ''           1            33.3

'Today'                                                                            1           33.0               'red'        2         66.0

Labels (5)

• ### table

Tags (5)
1 Solution
SplunkTrust

Use a different delimiter character - try this

| eventstats count as namecount by name
| eventstats count as colorcount by color
| eventstats count as statuscount by status
| eventstats count(name) as nametotal
| eventstats count(color) as colortotal
| eventstats count(status) as statustotal
| eval name=printf("%04u|%s|%d", 10000-namecount, name, nametotal)
| eval color=printf("%04u|%s|%d", 10000-colorcount, color, colortotal)
| eval status=printf("%04u|%s|%d", 10000-statuscount, status, statustotal)
| stats values(name) as name values(color) as color values(status) as status
| eval cname=mvmap(name,10000-tonumber(mvindex(split(name,"|"),0)))
| eval ccolor=mvmap(color,10000-tonumber(mvindex(split(color,"|"),0)))
| eval cstatus=mvmap(status,10000-tonumber(mvindex(split(status,"|"),0)))
| eval pname=mvmap(name,100*(10000-tonumber(mvindex(split(name,"|"),0)))/tonumber(mvindex(split(name,"|"),2)))
| eval pcolor=mvmap(color,100*(10000-tonumber(mvindex(split(color,"|"),0)))/tonumber(mvindex(split(color,"|"),2)))
| eval pstatus=mvmap(status,100*(10000-tonumber(mvindex(split(status,"|"),0)))/tonumber(mvindex(split(status,"|"),2)))
| eval name=mvmap(name,mvindex(split(name,"|"),1))
| eval color=mvmap(color,mvindex(split(color,"|"),1))
| eval status=mvmap(status,mvindex(split(status,"|"),1))
| fields name cname pname color ccolor pcolor status cstatus pstatus
SplunkTrust

Use a different delimiter character - try this

| eventstats count as namecount by name
| eventstats count as colorcount by color
| eventstats count as statuscount by status
| eventstats count(name) as nametotal
| eventstats count(color) as colortotal
| eventstats count(status) as statustotal
| eval name=printf("%04u|%s|%d", 10000-namecount, name, nametotal)
| eval color=printf("%04u|%s|%d", 10000-colorcount, color, colortotal)
| eval status=printf("%04u|%s|%d", 10000-statuscount, status, statustotal)
| stats values(name) as name values(color) as color values(status) as status
| eval cname=mvmap(name,10000-tonumber(mvindex(split(name,"|"),0)))
| eval ccolor=mvmap(color,10000-tonumber(mvindex(split(color,"|"),0)))
| eval cstatus=mvmap(status,10000-tonumber(mvindex(split(status,"|"),0)))
| eval pname=mvmap(name,100*(10000-tonumber(mvindex(split(name,"|"),0)))/tonumber(mvindex(split(name,"|"),2)))
| eval pcolor=mvmap(color,100*(10000-tonumber(mvindex(split(color,"|"),0)))/tonumber(mvindex(split(color,"|"),2)))
| eval pstatus=mvmap(status,100*(10000-tonumber(mvindex(split(status,"|"),0)))/tonumber(mvindex(split(status,"|"),2)))
| eval name=mvmap(name,mvindex(split(name,"|"),1))
| eval color=mvmap(color,mvindex(split(color,"|"),1))
| eval status=mvmap(status,mvindex(split(status,"|"),1))
| fields name cname pname color ccolor pcolor status cstatus pstatus
Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...