Splunk Search

How to edit my stats search to find the percentage of a range?

Explorer

I'm trying to build a simple SPL query to display the max, min, range (difference), and percent of the difference to the max value.

index=myindex source="mysource"| stats max(count), min(count), range(count)|rename max(count) to "Max", min(count) to "Min", range(count) to "Difference"

Tried using the perc(y) stats function with no luck... Also tried some basic math which blows up every time..

range(count) \ max(count)*100 

Thanks for your help in advance.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Hi, is count an existing field in your data?
If so try the following:

index=myindex source="mysource"
| stats max(count) as Max, min(count) as Min, range(count) as Difference
| eval Difference_Percent = Difference / Max * 100

If not, you need to calculate the value of count first (probably using stats count)

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Hi, is count an existing field in your data?
If so try the following:

index=myindex source="mysource"
| stats max(count) as Max, min(count) as Min, range(count) as Difference
| eval Difference_Percent = Difference / Max * 100

If not, you need to calculate the value of count first (probably using stats count)

View solution in original post

0 Karma

Explorer

Yes -"count" is an existing field . This worked - Thanks for the answer!

0 Karma
Don’t Miss Global Splunk
User Groups Week!

Free LIVE events worldwide 2/8-2/12
Connect, learn, and collect rad prizes
and swag!