Splunk Search

Percent of Subtotals

sondradotcom
Path Finder

Splunkers,

I'm trying to get splunk to help me with the analysis of survey responses. I have the command:

 * | stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand

Which results in a nice table breaking down responses to a question by gender:

Easy_to_Understand  Male Female 
Below Expectations  10  4   
Exceeds Expectations    25  22  
Meets Expectations  70  36

The problem is that an uneven number of Males and Females responded to the survey. So, instead of a table with count, I'd like a table with each cell showing a % of total male responses and female responses respectively, so something like:

Easy_to_Understand  Male Female 
Below Expectations  9%  6%  
Exceeds Expectations    23% 35% 
Meets Expectations  67% 58%

Any thoughts?

Thanks!
-S.

Tags (1)
0 Karma
1 Solution

jflomenberg
Splunk Employee
Splunk Employee

Sondra,

Give eventstats a try. Something along the lines of:

| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct

View solution in original post

jflomenberg
Splunk Employee
Splunk Employee

Sondra,

Give eventstats a try. Something along the lines of:

| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...