Splunk Search

How to get a ratio in the search results?

Ameszzz
Engager

Hi experts,

I was stuck in a quandary when I was trying to see which of my customer base was using optimization mode and I needed to get the percentage of optimization patterns used for each org sorted by orgId, so I tried using the following statement.

index=* type=* orgId=*
| eval Mode = case(type ==" non_opt", "None-Optimized", type=="opt", "Optimized")
| stats count by Mode, orgId
| sort count
| stats list(Mode), list(count) by orgId


But so far I only got the number of opt/non-opt users sorted by orgId, actually I want to calculate the value or percentage of opt/(opt + non-opt) and output the result grouped by orgId. How should I do?...

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Something like

index=* type=* orgId=*
| stats count by type, orgId
| eval opt_count = if(type == "opt", count, null())
| stats values(opt_count) as opt_percentage sum(count) as count by orgId
| eval opt_percentage = opt_percentage / count * 100

View solution in original post

Ameszzz
Engager

Thanks all for the help!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like

index=* type=* orgId=*
| stats count by type, orgId
| eval opt_count = if(type == "opt", count, null())
| stats values(opt_count) as opt_percentage sum(count) as count by orgId
| eval opt_percentage = opt_percentage / count * 100

ITWhisperer
SplunkTrust
SplunkTrust

Start with something like this

index=* type=* orgId=*
| eval Mode = case(type ==" non_opt", "None-Optimized", type=="opt", "Optimized")
| stats count by Mode, orgId
| eventstats sum(cout) as total by orgId
| eval percent=100*count/total
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...