Splunk Search
Highlighted

addcoltotals : do not sum percentages

Builder

Hello,

I'd like to do the following (screenshot at http://hpics.li/49c6c08), do not sum percentages but just following a calculation rule.

Thanks for your help.

Screenshot

0 Karma
Highlighted

Re: addcoltotals : do not sum percentages

Legend

Try this

... | eval "Recherches  sans rsultat" = if(Recherches="TOTAL", round(Rien/TOTAL, 2), "Recherches  sans rsultat")
Highlighted

Re: addcoltotals : do not sum percentages

Esteemed Legend

Like this (once you fix the umlauts):

... | eval $Recherches sans rsultat$ = if(like(Recherches, "TOTAL"), round((Rien/TOTAL), 2), "Recherches sans rsultat")
Highlighted

Re: addcoltotals : do not sum percentages

Builder

Solved, thanks guy.

final search :

| multisearch [ search index="xxx" sourcetype="xxxRecherche" | where NBResultat = 0 | rename NBResultat as SZERO ] [ search index="xxx" sourcetype="xxxRecherche" | where NBResultat > 0 | rename NBResultat as AZERO ] | stats count(AZERO) as totalsearch, count(SZERO) as totalfailed by Resultat | eval wresult=round(totalfailed/(totalfailed+totalsearch)100,0) | eval ctotal=totalfailed+totalsearch | eventstats sum(ctotal) as sumctotal | eval Un=round(ctotal/sumctotal100,0) | eval Recherches=case(Resultat="null","Cadas (U".Un."%)",Resultat="EXACT","Exact (U".Un."%)",Resultat="APPROXIMATIF","Approximatif (U".Un."%)") | table Recherches,totalsearch,totalfailed, ctotal, wresult | eval zresult=tostring(wresult) + "%" | addcoltotals labelfield=Recherches label=TOTAL | rename totalsearch as "Résultats trouvés", totalfailed as "Rien", zresult as "Recherches sans résultat", ctotal as TOTAL | fields - wresult | eval "Recherches sans résultat"=if(like(Recherches,"TOTAL"),round((Rien/TOTAL),2)100,round(Rien/TOTAL100,0))

View solution in original post

0 Karma
Highlighted

Re: addcoltotals : do not sum percentages

Esteemed Legend

OK, now click Accept for the answer that you like best to close the question.

0 Karma
Highlighted

Re: addcoltotals : do not sum percentages

Builder

Ok thanks again 🙂

0 Karma