Splunk Search

Use an eval statement to find a percentage

jregexsaurus
Engager

index=proxy sourcetype=bar
| stats count by blockedAction
| addtotals fieldname=grandTotal
| eval percentBlocked = round((blockedAction/grandTotal)*100,1)

I'm trying to show the amount blocked as a percent of total traffic. BlockedAction is a field that was created.

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

The simplest way is to use the top command

index=proxy sourcetype=bar
| top 0 blockedAction

but you can do this other ways, such as 

index=proxy sourcetype=bar
| stats count by blockedAction
| eventstats sum(count) as grandTotal
| eval percentBlocked = round((count/grandTotal)*100,1)
| fields - grandTotal

Hope this helps

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would be helpful to know what results you get from that query, but I expect you get no results.  If you do get results then they're likely to be inaccurate because the blockedAction field is a label rather than a count.

Try this variation on your query.

index=proxy sourcetype=bar
| stats count as grandTotal, sum(eval(blockedAction="blocked")) as blockedCount
| eval percentBlocked = round((blockedCount/grandTotal)*100,1)
---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

The simplest way is to use the top command

index=proxy sourcetype=bar
| top 0 blockedAction

but you can do this other ways, such as 

index=proxy sourcetype=bar
| stats count by blockedAction
| eventstats sum(count) as grandTotal
| eval percentBlocked = round((count/grandTotal)*100,1)
| fields - grandTotal

Hope this helps

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...