Splunk Search

Show subtotals as percentages in Pivot Statistics Table

postrational
Engager

I have a Pivot displayed as a Statistics Table, which is defined by the following search:

| pivot My_Object SearchObject count(SearchObject) AS "Count of My_Object" SPLITROW name AS "Name" SPLITCOL status SORT 100 name ROWSUMMARY 0 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

This works nicely and in every row I see a count of search objects, split by the "status" field followed by a column with the heading "ALL", which displays the total.

I would like to change the display to show percentages instead of raw counts. I other words, I would like to see the value from each status column divided by the value from the "ALL" column (as percent).

Is there a way to do this using Pivot?

dm1
Contributor

Were you able to find answer to this ? if yes, could you please share ?

0 Karma

vganjare
Builder

Hi,

You can try using subsearch to return the total count value. Copy this value in a field which can be used for percentage calculation.

A field value can be returned using *return $FIELD_NAME * command.

Thanks!!

0 Karma

postrational
Engager

Should I add the subsearch as a field to the data object, or maybe as a child object to the data model, or should I add it to the "| pivot " search as in pivot My_Object SearchObject count(SearchObject)/[subsearch]?

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...