Splunk Search

percent of sum over total elapsed time


I'd like to write a report in Splunk that would give me sum(downTimeInSec) as a percentage of total time, 3 days.

The search, "site=" |chart sum(downTimeInSec) by site, gives me this
63660-Sao Paulo Campinas 736

I'd like to have something like this:

63660-SaoPauloCampinas 736 .28394%

where the 3rd column is calculated as follows ((736 sec * 100%)/(3 days*86400 sec/day))
Thanks in advance for your help.

Tags (2)



Could you try to use the following search conditions?

| stats sum(downTimeInSec) AS TotalDowmTimeInSec by site
| eval ratio = round(TotalDownTimeInSec * 100 / (3*24*60*60), 5)."%"

I hope it helps you.


0 Karma



You could use like that:

index=downtimes | addinfo | eval reportDuration=info_max_time-info_min_time | stats sum(downTimeInSec) AS totalDowntime, values(reportDuration) AS reportDuration by site | eval percentDown=(totalDowntime*100)/reportDuration

the addinfo will add some information related to your search, and now you can use it. You report will show the % based on the period you searched.


here's my event line for the question
7/16/14 10:28:45.000 AM Jul 16 10:28:45 2014-7-16T10:28:45-08:00 source 14 site=Sao Paulo Campinas, downTimeInSec=736, startTime=2014-07-16T10:16:29-08:00, endTime=2014-7-16T10:28:45-08:00

0 Karma
Get Updates on the Splunk Community!

Using Machine Learning for Hunting Security Threats

WATCH NOW Seeing the exponential hike in global cyber threat spectrum, organizations are now striving more for ...

Observability Newsletter Highlights | March 2023

 March 2023 | Check out the latest and greatestSplunk APM's New Tag Filter ExperienceSplunk APM has updated ...

Security Newsletter Updates | March 2023

 March 2023 | Check out the latest and greatestUnify Your Security Operations with Splunk Mission Control The ...