Splunk Search

Is there a way to divide the addcoltotals from each case statement in my search?

jhayIV
Engager

Is there a way to divide the addcoltotals from each case statement in the following :

eval daysclass=case(
NoOfDays<=14,"0-14 DAYS ",
NoOfDays>15 AND NoOfDays<=28,"14-28 DAYS ",
NoOfDays>29 AND NoOfDays<=42,"28-42 DAYS ",
NoOfDays>43 AND NoOfDays<=56,"42-56 DAYS",
NoOfDays>57, "56 DAYS OR MORE "
,1=1,"NULL")|search daysclass!=NULL|stats count(Name) AS "COUNT" by daysclass| ADDCOLTOTALS
0 Karma

cmerriman
Super Champion

if i get what you're doing, i think this might work:

eval daysclass=case(
 NoOfDays<=14,"0-14 DAYS ",
 NoOfDays>15 AND NoOfDays<=28,"14-28 DAYS ",
 NoOfDays>29 AND NoOfDays<=42,"28-42 DAYS ",
 NoOfDays>43 AND NoOfDays<=56,"42-56 DAYS",
 NoOfDays>57, "56 DAYS OR MORE "
 ,1=1,"NULL")|search daysclass!=NULL|stats count(Name) AS "COUNT" by daysclass|eventstats sum(COUNT) as total|eval divide=COUNT/total
0 Karma
Get Updates on the Splunk Community!

Automatic Discovery Part 1: What is Automatic Discovery in Splunk Observability Cloud ...

If you’ve ever deployed a new database cluster, spun up a caching layer, or added a load balancer, you know it ...

Real-Time Fraud Detection: How Splunk Dashboards Protect Financial Institutions

Financial fraud isn't slowing down. If anything, it's getting more sophisticated. Account takeovers, credit ...

Splunk + ThousandEyes: Correlate frontend, app, and network data to troubleshoot ...

 Are you tired of troubleshooting delays caused by siloed frontend, application, and network data? We've got a ...