Splunk Search

How to get percentage from customer of different reports?

Explorer

Hi community!

I would like to make the number inside the red circle to be a percentage based on the total customer in the blue box.
The code for the chart is:

...
|eval date_transfer=coalesce(date_created_tfo,date_call) 
|join sku_name
   [search index=index_products_production
   |eval group_name=if(isnull(group_name),"NUL",group_name)]</code>
|eval year=strftime(strptime(date_transfer, "%Y-%m-%d"),"%Y")
|search group_name!="NUL"
|chart dc(customers_name) by group_name year

While the code for the distinct customers is:

...
|join sku_name
   [search index=index_products_production
   |eval group_name=if(isnull(group_name),sku_name,group_name)]
|search $country$
|stats dc(customers_name) as "Number of Distinct Customer"

alt text

Tags (2)
0 Karma
1 Solution

SplunkTrust
SplunkTrust

One feasible way that would be pretty easy is to write the value of the blue box out to a token, and then use that token to divide all the numbers to get your desired percentage.

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

One feasible way that would be pretty easy is to write the value of the blue box out to a token, and then use that token to divide all the numbers to get your desired percentage.

View solution in original post

0 Karma

Explorer

you, sir, are a genius.
thank you so much!

Motivator

hey@andrehl,

You can try something like this:
index=_internal |stats count by sourcetype | eventstats sum(count) AS Total | eval percent=round(count/Total*100,2) | fields - Total count

If you want to display both count and percentage than you can use chart overlay.
Let me know if this helps!!

0 Karma