Splunk Search

Search uniq into array, new search Where uniq array into another search to get percentage

jbanhome
New Member

Hi,

Can you please point me into right direction or already answered good topic about one Splunk search where I have indexed.

Example data:
Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes

Now I want first to dedup (or get unique vaules into array -> Yo and Bro)
and then get chart results in percentages like
Yo 75% Yes, 25% No
Bro 50% Yes, 50% No.

And probably put in into Chart where X axis will be Yo, Bro, .... and Y axis percentage in 2 colors. 🙂

Thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.
table

If you use stats early ,you can make better query.

View solution in original post

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.
table

If you use stats early ,you can make better query.

0 Karma

jbanhome
New Member

Followed: https://answers.splunk.com/answers/438609/calculate-sum-of-multiple-fields-in-different-line.html
This gives me good starting point and I get search to search what I need with good results.

0 Karma
Get Updates on the Splunk Community!

Stay Connected: Your Guide to July Tech Talks, Office Hours, and Webinars!

What are Community Office Hours?Community Office Hours is an interactive 60-minute Zoom series where ...

Updated Data Type Articles, Anniversary Celebrations, and More on Splunk Lantern

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

A Prelude to .conf25: Your Guide to Splunk University

Heading to Boston this September for .conf25? Get a jumpstart by arriving a few days early for Splunk ...