Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- calculate percentage
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Hi,
I have a requirement wherein I am using bucket to calculate range and their values.
host="hobbes8" |search success OR fail|eventstats count(txnId) as gtotal |bucket api_time bins=100|eventstats count(txnId) as total by api_time|eval percent=100*total/gtotal |table api_time,percent,total.
I am getting my result but im getting many dupliicate entries. An when I am using stats I am getting the error. api_time should be numerical. Can you help me with this.
I need the result like this.
api_time percent total
1 1500-1600 0.277316 10
2 400-500 6.211869 224
3 800-900 2.329451 84
4 300-400 6.267332 226
Regards,
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Stats does have the ability to print non-numerical values; I'm not sure why it would complain about them, unless there was a syntax error somewhere in your query . Try the following instead of the pipe to "table" to display your results:
... | stats values(percent) AS "Percent", values(total) AS "Total" by api_time
If you still get duplicate values, you might want to look into the "dedup" command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dedup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Thankq that helped and worked.
Regards,
Harish
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Stats does have the ability to print non-numerical values; I'm not sure why it would complain about them, unless there was a syntax error somewhere in your query . Try the following instead of the pipe to "table" to display your results:
... | stats values(percent) AS "Percent", values(total) AS "Total" by api_time
If you still get duplicate values, you might want to look into the "dedup" command: http://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Dedup
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
api_time percent total
1500-1600 0.277316 10
400-500 6.211869 224
800-900 2.329451 84
300-400 6.267332 226
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
[Puzzles] Solve, Learn, Repeat: Matching cron expressions
Design, Compete, Win: Submit Your Best Splunk Dashboards for a .conf26 Pass
May 2026 Splunk Expert Sessions: Security & Observability
