Percentage based on Grand Total

[andrehl]

index="stage"
|stats dc(customers_name) as "Distinct Customer" by sku_name sku_number
|rename sku_name as Product sku_number as ID
|eval Rate=""Distinct Customer" / count(customers_name)"."%"

Hi guys,
I'm trying to calculate the percentage of the customer involved with respect to the grand total number of customers but I cant seem to use count under eval. Any help?

Thank you!

[richgalloway · Accepted solution]

count is a stats function, not an eval function. You need to calculate count(customers_name) in a separate command.

index="stage"
| eventstats count(customers_name) as customerCount dc(customers_name) as "Distinct Customer" by sku_name sku_number
|rename sku_name as Product sku_number as ID
|eval Rate=('Distinct Customer' / customerCount)."%"

[andrehl]

Is it still possible to sort if we have characters under eval command?

[niketn]

@andrehl, which version of Splunk are you on? Also what is the visualization to depict above output? Is it table or something else?

If you are on Splunk 6.5 or higher you can use Table format option to add Unit as % rather than adding % in the eval SPL command. This way your data remains numeric and still displays % in the column.

Refer to Splunk Documentation: https://docs.splunk.com/Documentation/Splunk/latest/Viz/TableFormatsXML#Number_format_rules