Splunk Search

Show subtotals as percentages in Pivot Statistics Table

postrational
Engager

I have a Pivot displayed as a Statistics Table, which is defined by the following search:

| pivot My_Object SearchObject count(SearchObject) AS "Count of My_Object" SPLITROW name AS "Name" SPLITCOL status SORT 100 name ROWSUMMARY 0 COLSUMMARY 1 NUMCOLS 100 SHOWOTHER 1

This works nicely and in every row I see a count of search objects, split by the "status" field followed by a column with the heading "ALL", which displays the total.

I would like to change the display to show percentages instead of raw counts. I other words, I would like to see the value from each status column divided by the value from the "ALL" column (as percent).

Is there a way to do this using Pivot?

dm1
Contributor

Were you able to find answer to this ? if yes, could you please share ?

0 Karma

vganjare
Builder

Hi,

You can try using subsearch to return the total count value. Copy this value in a field which can be used for percentage calculation.

A field value can be returned using *return $FIELD_NAME * command.

Thanks!!

0 Karma

postrational
Engager

Should I add the subsearch as a field to the data object, or maybe as a child object to the data model, or should I add it to the "| pivot " search as in pivot My_Object SearchObject count(SearchObject)/[subsearch]?

0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...