×

Are you a member of the Splunk Community?

Sign in or Register with your Splunk account to get your questions answered, access valuable resources and connect with experts!
cancel
Turn on suggestions
Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.
Showing results for 
Show  only  | Search instead for 
Did you mean: 
Ask a Question
sudheeraha
Engager
Member since: ‎03-18-2019
‎06-05-2020
Community Statistics
Posts 2
Solutions 0
Karma Given 1
Karma Received 0
Member Since ‎03-18-2019
View All

Re: How to create a search to get count total with...

by in Splunk Search
‎03-18-2019 03:59 PM
‎03-18-2019 03:59 PM
Thanks for your reply. It worked to some extend. Apparently cannot see the out put column for the last statement )"| eval percentage=((count/GrandTotal)*100)". Further how can I add the time stamp range column as well to figure out the time period. Basically what time of the day these records created. (perhaps time range not exact time) Thanks ... View more

How to create a search to get count total with per...

by in Splunk Search
‎03-18-2019 06:02 AM
‎03-18-2019 06:02 AM
Hi there, I have below result with this query. index="abc" Properties.CorrelationId != XYZ | stats count by Properties.CorrelationId | sort - count | eventstats sum(count) as totalCount | eval percentage=((count/totalCount)*100) Result: Properties.CorrelationId count percentage totalCount 23F4991E-EB37-447A-6702-44B7834DA0E2 7 63.63 33 A8D81A89-2D6A-48AD-733B-CD0A802F62B8 7 63.63 33 D85CB087-6BE9-419E-670A-BD9770525A15 7 63.63 33 1200CC97-6615-4AF4-7586-DC00207AB1E8 6 36.36 33 18F8F6C7-752A-42DB-5880-ABE0BF8E5DE2 6 36.36 33 But what I after is below result. without the Properties.CorrelationId column Count Total percentage Grand Total 7 3 63.63 33 6 2 36.36 33 ... View more
Contact Me
Online Status
Offline
Date Last Visited
‎06-05-2020 02:04 AM
Karma given to
View All