Splunk Search

How to sum(field) depending on another field

marina_rovira
Contributor

Hello all,

I have a field called Type with three values and I want a chart of the percentage of these three values. I am looking for a chart like this, which is easy to achieve:

alt text

But with the % value over the total count of another field for each type. I have a field called Count, that I want to sum for each type, so by now, my search is this:

| timechart sum(Count) by Type

The thing is that I cannot find a way to sum this field depending of the Type field. If I had the sum, I could calculate the percentage myself.

Someone knows if I can do it?

Thanks in advance!

0 Karma
1 Solution

somesoni2
Revered Legend

Try something like this

your base search | bucket span=1mon _time | stats sum(count) as count by _time Type | eventstats sum(count) as Total by _time | eval Percent=round(count*100/Total) | timechart span=1mon max(Percent) by Type

View solution in original post

somesoni2
Revered Legend

Try something like this

your base search | bucket span=1mon _time | stats sum(count) as count by _time Type | eventstats sum(count) as Total by _time | eval Percent=round(count*100/Total) | timechart span=1mon max(Percent) by Type

fdi01
Motivator

to chart of the percentage of these three values , try like :

...| top  Type

or
try thi :

...| stats count by Type | eventstats sum(count) as total | eval percent = round(count/total) . " %" | fields - total

marina_rovira
Contributor

It works! for one month, do you if there is a possibility to do it over month? as a timechart or something?

Thank you!

0 Karma

fdi01
Motivator

try like:

...|bucket _time span=1months| top  Type by _time

marina_rovira
Contributor

Thank you so much! 🙂

0 Karma

marina_rovira
Contributor

okay, I'm approaching to it.

I need a mix of these two queries, noy I have:

  • on one hand:
    | stats sum(Count) as suma by Type | eventstats sum(suma) as total | eval percent = round((suma/total)*100,0)."%"

  • on the other hand:
    |bucket _time span=1months| top Type by _time

Now, I need to sum the field Count for Type and moth. With this last thing you wrote me, I almost achieve it, but it counts the events and I need to sum a field for the events.

Thanks, you're helping me a lot!

0 Karma
Get Updates on the Splunk Community!

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud

Introduction to Splunk Observability Cloud - Building a Resilient Hybrid Cloud  In today’s fast-paced digital ...

Observability protocols to know about

Observability protocols define the specifications or formats for collecting, encoding, transporting, and ...

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...