Splunk Search

Search uniq into array, new search Where uniq array into another search to get percentage

jbanhome
New Member

Hi,

Can you please point me into right direction or already answered good topic about one Splunk search where I have indexed.

Example data:
Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes

Now I want first to dedup (or get unique vaules into array -> Yo and Bro)
and then get chart results in percentages like
Yo 75% Yes, 25% No
Bro 50% Yes, 50% No.

And probably put in into Chart where X axis will be Yo, Bro, .... and Y axis percentage in 2 colors. 🙂

Thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.
table

If you use stats early ,you can make better query.

View solution in original post

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.
table

If you use stats early ,you can make better query.

0 Karma

jbanhome
New Member

Followed: https://answers.splunk.com/answers/438609/calculate-sum-of-multiple-fields-in-different-line.html
This gives me good starting point and I get search to search what I need with good results.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...