Splunk Search

How to calculate the percentage of certain field occurence in the events ?

zacksoft_wf
Contributor

In my events, there is a field called "is_interactive"  which has value of either 0 or 1.
Now the thing is, not all of my events has the field "is_interactive" in them.
How to do I know, how much of of my events have this field in them ?

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

stats count(is_interactive)

| makeresults count=20 
| eval is_interactive=random()%2
| eval is_interactive=if(random()%2 == 0,null(),is_interactive)
``` the lines above generate some random dummy data ```
| stats count count(is_interactive) as interactive sum(is_interactive) as total

This show total count, those events where is_interactive is not null, and the sum of the is_interactive to show that some of the is_interactive values are zero

0 Karma
Get Updates on the Splunk Community!

SOC4Kafka - New Kafka Connector Powered by OpenTelemetry

The new SOC4Kafka connector, built on OpenTelemetry, enables the collection of Kafka messages and forwards ...

Your Voice Matters! Help Us Shape the New Splunk Lantern Experience

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Building Momentum: Splunk Developer Program at .conf25

At Splunk, developers are at the heart of innovation. That’s why this year at .conf25, we officially launched ...