Splunk Search

Search uniq into array, new search Where uniq array into another search to get percentage

jbanhome
New Member

Hi,

Can you please point me into right direction or already answered good topic about one Splunk search where I have indexed.

Example data:
Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes

Now I want first to dedup (or get unique vaules into array -> Yo and Bro)
and then get chart results in percentages like
Yo 75% Yes, 25% No
Bro 50% Yes, 50% No.

And probably put in into Chart where X axis will be Yo, Bro, .... and Y axis percentage in 2 colors. 🙂

Thanks.

Labels (2)
Tags (1)
0 Karma
1 Solution

to4kawa
Ultra Champion
|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.
table

If you use stats early ,you can make better query.

View solution in original post

0 Karma

to4kawa
Ultra Champion
|makeresults
| eval _raw="Value, Passed
Yo, Yes
Yo, Yes
Yo, No
Bro, No
Bro, Yes"
| multikv forceheader=1
| table Value, Passed
| foreach * [ eval <<FIELD>> = trim('<<FIELD>>')]
| rename COMMENT as "This is your sample, From here, the logic"
| stats count as Total count(eval(Passed="Yes")) as Yes count(eval(Passed="No")) as No by Value
| eval Yes = Yes / Total * 100, No = No / Total * 100
| fields - Total

This query makes chart from table.
table

If you use stats early ,you can make better query.

0 Karma

jbanhome
New Member

Followed: https://answers.splunk.com/answers/438609/calculate-sum-of-multiple-fields-in-different-line.html
This gives me good starting point and I get search to search what I need with good results.

0 Karma
Get Updates on the Splunk Community!

AppDynamics Summer Webinars

This summer, our mighty AppDynamics team is cooking up some delicious content on YouTube Live to satiate your ...

SOCin’ it to you at Splunk University

Splunk University is expanding its instructor-led learning portfolio with dedicated Security tracks at .conf25 ...

Credit Card Data Protection & PCI Compliance with Splunk Edge Processor

Organizations handling credit card transactions know that PCI DSS compliance is both critical and complex. The ...