Thank you ITWhisperer Is there a way to achieve this ? Whether i can create a new field Status and bring the values into that field ? Please tell me if there a way available to do this too.   ... View more

Helo  ,can someone provide me the solution for this . ... View more

Hi PickleRick, The below one is the one which triggered that. I have to get % of 2 and 3 values in a same field . Status count  True       200 False       50 Error      10 exc          5 temp      6 Total   271 I need to get true% by  true+error /Total * 100 and False% by False+exc+temp/Total*100. Please help me with the solution .   ... View more

Please let me know whether we can show in other formats too .     ... View more

Hi Ismo, Thank you !! | stats count(eval("Status"="True")) as True count(eval("Status"="False")) as "False" I am getting , True False  0         0 Please help me out  ... View more

Please help me to get solution for this . ... View more

Thank you kamlesh_vaghela, When i tried this i am getting the count as 0 for both true and false . Adding to that , Sum(true) and sum(false) for each service is my need . Any other way to achieve this ?   ... View more

Thank you manjunathmeti , It gives count of each service (true and false ) and the the sum of (true and false) | eval count_of_true=212, count_of_false=313 This is dynamic value which i will get after sum(true) and sum(false) and not the static one . is there any other way ? ... View more

Thanks for your reply KV . I got it by changing , | eval "dbyest Pass %"=round((Pass/Total)*100,3)   as  | eval "dbyest Pass%"=round(('Pass'/Total)*100,3)  and that worked .   ... View more

kamlesh_vaghela  Thanks for your reply !! But i am not seeing any value in the table command for "Pass % diff" after that .Can you please provide any other solution for this .   ... View more

i need to merge the values with similar values ad the related count in one row as we get out put in SQL query.We use Sql view as input to the index here. Percentage is calculated like (true/machines tested*100,2). My search : |eval Percent=round(sum(CountOf_true)/sum(CountOf_MaAchinesTested)*100,2)|eval "Percent of True Machines Tested"=case(Percent==0,0.00,1=1,Percent)|stats sum(CountOf_MachinesTested) as "Machines Tested" sum(CountOf_True) as True sum(CountOf_False_AssetsTested) as "False by Platform Environment "Tested"  Rule Severity "Percent of True Machines Tested"|sort Tested Rule  I hope this will help you ..         Platform Environment Tested Rule  Severity Percent of true machines Tested true false mns DEV ALB Security Baseline 3.2.1 ALB's should not be public High 100.00 43 43 0 mns LAB ALB Security Baseline 3.2.1 ALB's should not be public High 100.00 1 1 0 mns PROD ALB Security Baseline 3.2.1 ALB's should not be public High 100.00 10 10 0 mns PROD ALB Security Baseline 3.2.1 ALB's should not be public High 60.00 15 9 6 mns PROD  ALB Security Baseline 3.2.1 ALB's should not be public High 90.91 22 20 2 mns PSE ALB Security Baseline 3.2.1 ALB's should not be public High 100.00 4 4 0 mns PSE ALB Security Baseline 3.2.1 ALB's should not be public High 83.33 6 5 1 mns PSE ALB Security Baseline 3.2.1 ALB's should not be public High 90.91 11 10 1 ... View more

Thank you for continues support. I have recreated the sourcetype from same view but no success .All other stuffs are working fine ,but not sure why it happens to this alone.   ... View more

Yes the count i am getting is consistent ,but few rows in the Null values need to be moved to No and few to Yes as per warehouse view .But not sure how to segregate that as expected. ... View more

Can you please help me out in this issue. ... View more

Yes , You are right . But the warehouse (sql) view has data for all and when i run the view it gives expected count and the not the count given by splunk. Any splunk issue ? i need to add any command to grab the values in splunk from warehouse ? This is the first time i am facing this issue and its a strange one .       ... View more

Thank you ITwhisperer. I am getting the same count ie 44 as earlier after using your search which is not expected count . No , 5 rows of Z doesn't have value. But when i run the below search  index=x sourcetype=Y |fillnull| search reporting="0" , i am getting 35 rows as results and this causes the count mismatch . All the reporting rows has values either yes or no in it in events page .The reporting field in interesting field area also has count mismatch . Not sure why events page has values but not in interesting field.Can you help me to solve this issue. ... View more