finding percentage

[rabrahaham]

Good Day all, 

I would like to find the percentage of devices that has updated. The way I would like to do this is to first search index=main | stats dc(Host_Name). This would give me the total number of host names that are sending data to splunk. Out of that I would like to find out what percentage of those is updated. I can search index=main update* | stats dc(Host_Name) and it will give the number of devices that have updated. But how will I find the percentage of devices that have updated? Normally it would be (devices updated/total devices)*100. For this search how do we craft the search?

Thanks

[richgalloway · Accepted solution]

Here is one way to combine the two searches.

index=main
| eval update=if(searchmatch("update*"), Host_Name, NULL) 
| stats dc(update) as updated, dc(Host_Name) as total 
| fillnull value=0 updated 
| eval pct=round((updated*100)/total,2)