Splunk Search

How to calculate the percentages of the field values (yes/no) in a field?

pavanae
Builder

Hi I have a Splunk search as follows:

My search | table host_name, last_seen_in_24hours

which displays the result as follows
alt text
Now I'm trying to see the percentage of YES's and NO's in a pie chart.

0 Karma
1 Solution

somesoni2
Revered Legend

Just add this to end of your search and select pie chart visualization

your current search | stats count by last_seen_in_24hours

View solution in original post

niketn
Legend

@pavanae, in case your hosts can have duplicate data for last_seen_in_24_hours, you would need to dedup or get latest value per host

<YourBaseSearch>
| stats last(last_seen_in_24_hours) as last_seen_in_24_hours by host
| stats count by last_seen_in_24_hours

Or

<YourBaseSearch>
| dedup host
| stats count by last_seen_in_24_hours
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
Revered Legend

Just add this to end of your search and select pie chart visualization

your current search | stats count by last_seen_in_24hours
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...