How can I obtain the percentage of zero values in a lookup table? I have tried the following command without success: | inputlookup input.csv | fieldsummary | fields field | map search="| inputlookup input.csv | stats count(eval($$field$$ == 0)) as count_zeros | eval field=$$field$$" | eval zeros(%) = round((count_zeros*100)/10000,2) | fields zeros(%) A sample of the dataset "input.csv" is the following: pickup_community_area fare trip_start_month trip_start_hour trip_start_day trip_start_timestamp pickup_latitude pickup_longitude dropoff_latitude dropoff_longitude trip_miles pickup_census_tract dropoff_census_tract payment_type company trip_seconds dropoff_community_area tips 60 27.05 10 2 3 1380593700 41.836.150.155 -87.648.787.952 12.6 Cash Taxi Affiliation Services 1380 0.0 10 5.85 10 1 2 1382319000 41.985.015.101 -87.804.532.006 0.0 Cash Taxi Affiliation Services 180 0.0 14 16.65 5 7 5 1369897200 41.968.069 -87.721.559.063 0.0 Cash Dispatch Taxi Affiliation 1080 0.0 13 16.45 11 12 3 1446554700 41.983.636.307 -87.723.583.185 6.9 Cash 780 0.0 16 32.05 12 1 1 1417916700 41.953.582.125 -8.772.345.239 15.4 Cash 1200 0.0 30 38.45 10 10 5 1444301100 41.839.086.906 -87.714.003.807 14.6 Cash 2580 0.0 11 14.65 1 1 3 1358213400 41.978.829.526 -87.771.166.703 5.81 Cash 1080 0.0 33 3.25 5 17 1 1368985500 41.849.246.754 -87.624.135.298 0.0 Cash Taxi Affiliation Services 0 0.0 19 47.65 6 15 4 1372258800 41.927.260.956 -87.765.501.609 0.0 Cash Taxi Affiliation Services 3480 0.0 There are 18 columns and I am only obtaining results for 10 columns of the whole dataset. zeros(%) 0.00 0.00 0.00 0.00 0.00 0.17 0.00 0.00 0.00 0.00 ... View more

I have the following query in a form: | inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim="," | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup ouput.csv where input.csv has a column called values with this kind of data: [{"value":"6","count":835},{"value":"7","count":794},{"value":"5","count":733},{"value":"1","count":680},{"value":"4","count":675},{"value":"2","count":668},{"value":"3","count":615}] This query works like a charm in the Splunk Web search form, but I cannot make it work in a dashboard/form. I am using the following XML code without success: <search> <query>| inputlookup input.csv | fields feature values | spath input=values | fields - values | rename {}.count AS count | rename {}.value AS value | eval reading=mvzip(count, value) | mvexpand reading | makemv reading delim=&quot;,&quot; | eval count=mvindex(reading, 0) | eval value=mvindex(reading, 1) | fields - reading | outputlookup output.csv</query> </search> Am I missing something? I suspect that there must be a problem with escaping characters but I am not fully sure. ... View more