Splunk Search

How to edit my search to calculate percentage across columns for multiple fields?

Path Finder

Looking for some assistance with trying to fix my search to calculate percentage on several columns.

Here is what I am trying to see:

Count      3sec    3to10sec    10to30sec
X          X       X           X 
Percent    X%      X%          X%

Here is my search so far:

sourcetype="mcafee:wg:kv"  
 | rangemap field=time_total "0-3sec"=0-3000, "3-10sec"=3001-10000, "10-30sec"=10001-30000, "30sec-1min"=30001-60000, "1min-5min"=60001-300000, "5min-10min"=300001-600000, default=">10min"  
 | stats count as Count count(eval(range="0-3sec")) as 3sec count(eval(range="3-10sec")) as 3to10sec count(eval(range="10-30sec")) as 10to30sec count(eval(range="30sec-1min")) as 30secto1min count(eval(range="1min-5min")) as 1minto5min count(eval(range="5min-10min")) as 5minto10min count(eval(range=">10min")) as grt10min
0 Karma

Esteemed Legend

Like this:

sourcetype="mcafee:wg:kv"  
| eval time_total_buckets=case(time_total<=3000, "0-3sec",
                               time_total<=10000, "3-10sec",
                               time_total<=30000, "10-30sec",
                               time_total<=60000, "30sec-1min",
                               time_total<=300000, "1min-5min",
                               time_total<=600000, "5min-10min",
                               true(), ">10min")
| top limit=0 time_total_buckets
| addtotals row=f col=t 
| fillnull value="TOTAL" 
| multireport 
     [ fields - percent | eval RowType="count" ] 
     [ fields - count | rename percent AS count | eval RowType="percent"]
| xyseries RowType time_total_buckets count

Path Finder

works great... thanks!

0 Karma

Esteemed Legend

Be sure to click Accept to close the question.

0 Karma