Splunk Search

How to get a ratio in the search results?

Ameszzz
Engager

Hi experts,

I was stuck in a quandary when I was trying to see which of my customer base was using optimization mode and I needed to get the percentage of optimization patterns used for each org sorted by orgId, so I tried using the following statement.

index=* type=* orgId=*
| eval Mode = case(type ==" non_opt", "None-Optimized", type=="opt", "Optimized")
| stats count by Mode, orgId
| sort count
| stats list(Mode), list(count) by orgId


But so far I only got the number of opt/non-opt users sorted by orgId, actually I want to calculate the value or percentage of opt/(opt + non-opt) and output the result grouped by orgId. How should I do?...

Labels (1)
0 Karma
1 Solution

yuanliu
SplunkTrust
SplunkTrust

Something like

index=* type=* orgId=*
| stats count by type, orgId
| eval opt_count = if(type == "opt", count, null())
| stats values(opt_count) as opt_percentage sum(count) as count by orgId
| eval opt_percentage = opt_percentage / count * 100

View solution in original post

Ameszzz
Engager

Thanks all for the help!!!

0 Karma

yuanliu
SplunkTrust
SplunkTrust

Something like

index=* type=* orgId=*
| stats count by type, orgId
| eval opt_count = if(type == "opt", count, null())
| stats values(opt_count) as opt_percentage sum(count) as count by orgId
| eval opt_percentage = opt_percentage / count * 100

ITWhisperer
SplunkTrust
SplunkTrust

Start with something like this

index=* type=* orgId=*
| eval Mode = case(type ==" non_opt", "None-Optimized", type=="opt", "Optimized")
| stats count by Mode, orgId
| eventstats sum(cout) as total by orgId
| eval percent=100*count/total
Get Updates on the Splunk Community!

Announcing the Expansion of the Splunk Academic Alliance Program

The Splunk Community is more than just an online forum — it’s a network of passionate users, administrators, ...

Learn Splunk Insider Insights, Do More With Gen AI, & Find 20+ New Use Cases You Can ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Buttercup Games: Further Dashboarding Techniques (Part 7)

This series of blogs assumes you have already completed the Splunk Enterprise Search Tutorial as it uses the ...