Splunkers,
I'm trying to get splunk to help me with the analysis of survey responses. I have the command:
* | stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand
Which results in a nice table breaking down responses to a question by gender:
Easy_to_Understand Male Female
Below Expectations 10 4
Exceeds Expectations 25 22
Meets Expectations 70 36
The problem is that an uneven number of Males and Females responded to the survey. So, instead of a table with count, I'd like a table with each cell showing a % of total male responses and female responses respectively, so something like:
Easy_to_Understand Male Female
Below Expectations 9% 6%
Exceeds Expectations 23% 35%
Meets Expectations 67% 58%
Any thoughts?
Thanks!
-S.
Sondra,
Give eventstats a try. Something along the lines of:
| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct
Sondra,
Give eventstats a try. Something along the lines of:
| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct