Splunk Search

How to get percentage from customer of different reports?

andrehl
Explorer

Hi community!

I would like to make the number inside the red circle to be a percentage based on the total customer in the blue box.
The code for the chart is:

...
|eval date_transfer=coalesce(date_created_tfo,date_call) 
|join sku_name
   [search index=index_products_production
   |eval group_name=if(isnull(group_name),"NUL",group_name)]</code>
|eval year=strftime(strptime(date_transfer, "%Y-%m-%d"),"%Y")
|search group_name!="NUL"
|chart dc(customers_name) by group_name year

While the code for the distinct customers is:

...
|join sku_name
   [search index=index_products_production
   |eval group_name=if(isnull(group_name),sku_name,group_name)]
|search $country$
|stats dc(customers_name) as "Number of Distinct Customer"

alt text

Tags (2)
0 Karma
1 Solution

DalJeanis
Legend

One feasible way that would be pretty easy is to write the value of the blue box out to a token, and then use that token to divide all the numbers to get your desired percentage.

View solution in original post

0 Karma

DalJeanis
Legend

One feasible way that would be pretty easy is to write the value of the blue box out to a token, and then use that token to divide all the numbers to get your desired percentage.

0 Karma

andrehl
Explorer

you, sir, are a genius.
thank you so much!

deepashri_123
Motivator

hey@andrehl,

You can try something like this:
index=_internal |stats count by sourcetype | eventstats sum(count) AS Total | eval percent=round(count/Total*100,2) | fields - Total count

If you want to display both count and percentage than you can use chart overlay.
Let me know if this helps!!

0 Karma
Get Updates on the Splunk Community!

New Year, New Changes for Splunk Certifications

As we embrace a new year, we’re making a small but important update to the Splunk Certification ...

Stay Connected: Your Guide to January Tech Talks, Office Hours, and Webinars!

What are Community Office Hours? Community Office Hours is an interactive 60-minute Zoom series where ...

[Puzzles] Solve, Learn, Repeat: Reprocessing XML into Fixed-Length Events

This challenge was first posted on Slack #puzzles channelFor a previous puzzle, I needed a set of fixed-length ...