Splunk Search

## Percent of Subtotals

Path Finder

Splunkers,

I'm trying to get splunk to help me with the analysis of survey responses. I have the command:

`````` * | stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand
``````

Which results in a nice table breaking down responses to a question by gender:

``````Easy_to_Understand  Male Female
Below Expectations  10  4
Exceeds Expectations    25  22
Meets Expectations  70  36
``````

The problem is that an uneven number of Males and Females responded to the survey. So, instead of a table with count, I'd like a table with each cell showing a % of total male responses and female responses respectively, so something like:

``````Easy_to_Understand  Male Female
Below Expectations  9%  6%
Exceeds Expectations    23% 35%
Meets Expectations  67% 58%
``````

Any thoughts?

Thanks!
-S.

Tags (1)
1 Solution
Splunk Employee

Sondra,

Give eventstats a try. Something along the lines of:

``````| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct
``````
Splunk Employee

Sondra,

Give eventstats a try. Something along the lines of:

``````| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct
``````
Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...