Search uniq into array, new search Where uniq array into another search to get percentage

[jbanhome]

Hi,

Can you please point me into right direction or already answered good topic about one Splunk search where I have indexed.

Example data:
Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes

Now I want first to dedup (or get unique vaules into array -> Yo and Bro)
and then get chart results in percentages like
Yo 75% Yes, 25% No
Bro 50% Yes, 50% No.

And probably put in into Chart where X axis will be Yo, Bro, .... and Y axis percentage in 2 colors. 🙂

Thanks.

[to4kawa · Accepted solution]

|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.

If you use stats early ,you can make better query.

[jbanhome]

Followed: https://answers.splunk.com/answers/438609/calculate-sum-of-multiple-fields-in-different-line.html
This gives me good starting point and I get search to search what I need with good results.