Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- addtotals to calculate percentage

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

davidcraven02

Communicator

01-22-2018
07:58 AM

I am trying to calculate what percentage of Operating Systems have windows 10 installed out of the total number which in this example is 174.

I have used a table as the easiest way to try and achieve this but ideally I want to display the final values as a single value. However, any solution would be really useful now.

```
`GEN_ProductionWorkstations`
| join type=left machine
[ search index=ad source=otl_addnsscan
| eval machine=lower(name)]
| rename User_Name0 as LastKnownUser, Caption0 as operatingSystem, Version0 as Version, Model0 as Model
| rename data as IPAddress
| search machine="*"
| dedup machine
| stats count(machine) by operatingSystem
| addtotals col=t labelfield=totalOSCount label="osCount" fieldname="total"
| fillnull value="Total Client Estate" operatingSystem
| fields- count(machine) Product totalOSCount
```

1 Solution

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

FrankVl

Ultra Champion

01-22-2018
08:16 AM

I usually do that with a combination of eventstats (to add the total to each row) and eval (to divide row count by totals to get the percentage):

```
| eventstats sum(count) as totals
| eval percentage=100*count/totals
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

davidcraven02

Communicator

01-22-2018
08:21 AM

Thanks. How do I build this into my search?

Highlighted
##

Add it after line 9 and adjust the field names to match what you have / want and see which bits of lines 10-12 you still need.

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

FrankVl

Ultra Champion

01-22-2018
08:32 AM

Highlighted

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

493669

Super Champion

01-22-2018
09:04 AM

Hi @davidcraven02,

Try below:

```
`GEN_ProductionWorkstations`
| join type=left machine
[ search index=ad source=otl_addnsscan
| eval machine=lower(name)]
| rename User_Name0 as LastKnownUser, Caption0 as operatingSystem, Version0 as Version, Model0 as Model
| rename data as IPAddress
| search machine="*"
| dedup machine
| stats count(machine) as count by operatingSystem
| eventstats sum(count) as total
| eval percentage = ((count/total)*100)
|eval percentage =percentage ."%"
|table operatingSystem , count , percentage
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

davidcraven02

Communicator

01-22-2018
11:51 PM

Thanks this works! How could this be tweaked to be used as a single value display to show the '% of OS's on Windows 10' for example. When I include the below it calculates it as 100% as the other OS's have been removed from the table.

```
| search machine="*" operatingSystem="*10*"
```

Any ideas?

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

493669

Super Champion

01-22-2018
11:58 PM

have you tried to run this search at last of whole query?

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

davidcraven02

Communicator

01-23-2018
01:10 AM

Yes. In a table format it works correct. But I want to display is as a single value i.e 80% which reflects the percentage of a particular OS.

I have tried the below, but it only works if Windows 10 is listed first in this table which make sit not reliable.

```
`GEN_ProductionWorkstations`
| join type=left machine
[ search index=ad source=otl_addnsscan
| eval machine=lower(name)]
| rename User_Name0 as LastKnownUser, Caption0 as operatingSystem, Version0 as Version, Model0 as Model
| rename data as IPAddress
| search $companyCode$ operatingSystem="*" OR NOT operatingSystem="*"
| fillnull value="No OS listed" operatingSystem
| dedup machine
| stats count(machine) as count by operatingSystem
| eventstats sum(count) as total
| eval percentage = ((count/total)*100)
| eval percentage = round(percentage,2)
|eval percentage =percentage ."%"
|table percentage, operatingSystem , count ,
|sort operatingSystem
| fields- count
```

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

FrankVl

Ultra Champion

01-23-2018
01:25 AM

Filter for the OS of choice **after** evaluating the percentages.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: addtotals to calculate percentage

493669

Super Champion

01-23-2018
01:31 AM

yes as @FrankVl suggested `| search $companyCode$ operatingSystem="*" OR NOT operatingSystem="*"`

should be after percentage evaluation

Try below:

```
`GEN_ProductionWorkstations`
| join type=left machine
[ search index=ad source=otl_addnsscan
| eval machine=lower(name)]
| rename User_Name0 as LastKnownUser, Caption0 as operatingSystem, Version0 as Version, Model0 as Model
| rename data as IPAddress
| fillnull value="No OS listed" operatingSystem
| dedup machine
| stats count(machine) as count by operatingSystem
| eventstats sum(count) as total
| eval percentage = ((count/total)*100)
| eval percentage = round(percentage,2)
|eval percentage =percentage ."%"
| search $companyCode$ operatingSystem="*" OR NOT operatingSystem="*"
|table percentage, operatingSystem , count ,
|sort operatingSystem
| fields- count
```