Splunk Search

How to get a ratio in the search results?

Ameszzz
Engager

Hi experts,

I was stuck in a quandary when I was trying to see which of my customer base was using optimization mode and I needed to get the percentage of optimization patterns used for each org sorted by orgId, so I tried using the following statement.

index=* type=* orgId=*
| eval Mode = case(type ==" non_opt", "None-Optimized", type=="opt", "Optimized")
| stats count by Mode, orgId
| sort count
| stats list(Mode), list(count) by orgId


But so far I only got the number of opt/non-opt users sorted by orgId, actually I want to calculate the value or percentage of opt/(opt + non-opt) and output the result grouped by orgId. How should I do?...

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Something like

index=* type=* orgId=*
| stats count by type, orgId
| eval opt_count = if(type == "opt", count, null())
| stats values(opt_count) as opt_percentage sum(count) as count by orgId
| eval opt_percentage = opt_percentage / count * 100

View solution in original post

Ameszzz
Engager

Thanks all for the help!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like

index=* type=* orgId=*
| stats count by type, orgId
| eval opt_count = if(type == "opt", count, null())
| stats values(opt_count) as opt_percentage sum(count) as count by orgId
| eval opt_percentage = opt_percentage / count * 100

ITWhisperer
SplunkTrust
SplunkTrust

Start with something like this

index=* type=* orgId=*
| eval Mode = case(type ==" non_opt", "None-Optimized", type=="opt", "Optimized")
| stats count by Mode, orgId
| eventstats sum(cout) as total by orgId
| eval percent=100*count/total
Get Updates on the Splunk Community!

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...

Index This | What goes away as soon as you talk about it?

May 2025 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this month’s ...

What's New in Splunk Observability Cloud and Splunk AppDynamics - May 2025

This month, we’re delivering several new innovations in Splunk Observability Cloud and Splunk AppDynamics ...