Splunk Search

Percent of Subtotals

sondradotcom
Path Finder

Splunkers,

I'm trying to get splunk to help me with the analysis of survey responses. I have the command:

 * | stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand

Which results in a nice table breaking down responses to a question by gender:

Easy_to_Understand  Male Female 
Below Expectations  10  4   
Exceeds Expectations    25  22  
Meets Expectations  70  36

The problem is that an uneven number of Males and Females responded to the survey. So, instead of a table with count, I'd like a table with each cell showing a % of total male responses and female responses respectively, so something like:

Easy_to_Understand  Male Female 
Below Expectations  9%  6%  
Exceeds Expectations    23% 35% 
Meets Expectations  67% 58%

Any thoughts?

Thanks!
-S.

Tags (1)
0 Karma
1 Solution

jflomenberg
Splunk Employee
Splunk Employee

Sondra,

Give eventstats a try. Something along the lines of:

| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct

View solution in original post

jflomenberg
Splunk Employee
Splunk Employee

Sondra,

Give eventstats a try. Something along the lines of:

| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...