Splunk Search

Show subtotals as percentages in Pivot Statistics Table

postrational
Engager

I have a Pivot displayed as a Statistics Table, which is defined by the following search:

| pivot My_Object SearchObject count(SearchObject) AS "Count of My_Object" SPLITROW name AS "Name" SPLITCOL status SORT 100 name ROWSUMMARY 0 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

This works nicely and in every row I see a count of search objects, split by the "status" field followed by a column with the heading "ALL", which displays the total.

I would like to change the display to show percentages instead of raw counts. I other words, I would like to see the value from each status column divided by the value from the "ALL" column (as percent).

Is there a way to do this using Pivot?

dm1
Contributor

Were you able to find answer to this ? if yes, could you please share ?

0 Karma

vganjare
Builder

Hi,

You can try using subsearch to return the total count value. Copy this value in a field which can be used for percentage calculation.

A field value can be returned using *return $FIELD_NAME * command.

Thanks!!

0 Karma

postrational
Engager

Should I add the subsearch as a field to the data object, or maybe as a child object to the data model, or should I add it to the "| pivot " search as in pivot My_Object SearchObject count(SearchObject)/[subsearch]?

0 Karma
Get Updates on the Splunk Community!

SplunkTrust Application Period is Officially OPEN!

It's that time, folks! The application/nomination period for the 2025 SplunkTrust is officially open! If you ...

Splunk Answers Content Calendar, June Edition II

Get ready to dive into Splunk Dashboard panels this week! We'll be tackling common questions around ...

Splunk Observability Cloud's AI Assistant in Action Series: Auditing Compliance and ...

This is the third post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how to ...