Percent of Subtotals

[sondradotcom]

Splunkers,

I'm trying to get splunk to help me with the analysis of survey responses. I have the command:

 * | stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand

Which results in a nice table breaking down responses to a question by gender:

Easy_to_Understand  Male Female 
Below Expectations  10  4   
Exceeds Expectations    25  22  
Meets Expectations  70  36

The problem is that an uneven number of Males and Females responded to the survey. So, instead of a table with count, I'd like a table with each cell showing a % of total male responses and female responses respectively, so something like:

Easy_to_Understand  Male Female 
Below Expectations  9%  6%  
Exceeds Expectations    23% 35% 
Meets Expectations  67% 58%

Any thoughts?

Thanks!
-S.

[jflomenberg · Accepted solution]

Sondra,

Give eventstats a try. Something along the lines of:

| stats count(eval(Gender="Male")) as Male count(eval(Gender="Female")) as Female by Easy_to_Understand | eventstats sum(Male) as MaleSum sum(Female) as FemaleSum | eval MalePct=round(Male*100/MaleSum,1) . " %" | eval FemalePct=round(Female*100/FemaleSum,1) . " %" | table Easy_to_Understand, MalePct, FemalePct