Splunk Search

using addcoltotals

dolj
Explorer

Can you leverage the total derived using the addcoltotals command to support other calculations? i.e. can you use it to calculate a percentage? 

| addcoltotals count labelfield="total"
| eval percent=((count/total)*100)
| table host count percent

 

 

Tags (1)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

You can't use the total calculated by addcoltotals as it's in a new row at the bottom of the table, however, as @richgalloway the typical way to calculate percentages is to use eventstats to add up all the counts, so that the total is added to _every_ row in your data set, which you can then calculate the percentages with.

Then discard that calculated total field if you no longer need it

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Yes, the output of the addcoltotals command can be used to perform calculations.  The sample code, however, won't work.  That's because the value of the "total" field created by addcoltotals is text (the label) rather than a number so the eval will fail.

Another way to get percentages is to use eventstats to compute the total then eval the percentage.

| eventstats sum(count) as total
| eval percent=((count/total)*100)
| table host count percent

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...