Splunk Search

How to calculate the percentage of two columns?

ajromero
Path Finder

Need to calculate the percentage of two columns- I have a search that gives me a total of two columns and I need to get the percentage like this: is what % column "Today" is of column "Grand" 

Here is the search I'm using

Here is the search

`duo_index` extracted_eventtype=authentication NOT auth_log_version=v2 result=SUCCESS | eval factor=if(factor=="n/a",reason,factor) | where factor!="None" and factor!="null" | eval factor=upper(factor) | stats count by factor
| eventstats sum(count) as total |appendpipe [stats sum(count) as "equal"]

|append[search `duo_index` extracted_eventtype=authentication NOT auth_log_version=v2 result=FAILURE | eval factor=if(factor=="n/a",reason,factor) | where factor!="None" and reason!="null" | stats count by reason | eventstats sum(count) as total |appendpipe [stats sum(count) as "total2"] ]
|eval perc=(total2/equal)*100 |table perc equal total2

 

Thank you

Labels (3)
Tags (4)
0 Karma

renjith_nair
Legend

Not sure if it's as simple as

eval perc = (valueA/ValueB)*100

 

---
What goes around comes around. If it helps, hit it with Karma 🙂
0 Karma
Get Updates on the Splunk Community!

Detecting Remote Code Executions With the Splunk Threat Research Team

WATCH NOWRemote code execution (RCE) vulnerabilities pose a significant risk to organizations. If exploited, ...

Enter the Splunk Community Dashboard Challenge for Your Chance to Win!

The Splunk Community Dashboard Challenge is underway! This is your chance to showcase your skills in creating ...

.conf24 | Session Scheduler is Live!!

.conf24 is happening June 11 - 14 in Las Vegas, and we are thrilled to announce that the conference catalog ...