Splunk Search

How to get results for how often each alarm type occurs in percentage

marenastrauss
New Member

I have uploaded alarm logs into Splunk. I would like to be able to show results for how often each alarm type occurs in percentage.

For example, the percentage of total alarms that Alarm 1 makes up and the percentage that Alarm 2 takes up, to see which alarm occurs more.

Thank you!

0 Karma
1 Solution

renjith_nair
SplunkTrust
SplunkTrust

@marenastrauss ,

In general , below should work

"your search"|stats count by alarm_type|eventstats sum(count) as total | eval perc=round((count/total)*100)
Happy Splunking!

View solution in original post

0 Karma

renjith_nair
SplunkTrust
SplunkTrust

@marenastrauss ,

In general , below should work

"your search"|stats count by alarm_type|eventstats sum(count) as total | eval perc=round((count/total)*100)
Happy Splunking!
0 Karma

marenastrauss
New Member

That worked! I had to do it without round though because then it only gives back 0's. Thank you!

0 Karma

Sukisen1981
Champion

hi @marenastrauss
Then please accept the answer of @renjith.nair

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...