Splunk Search

Calculate % of each field as ratio?

Joycetran
New Member

I have the table:
_time Ip_1 Ip_2 Ip_3
a 36 40 31
b 37 39 21

I want to take the percentage of each IP instead count, like:
a 0.33 0.37 0.28
The table above From the query:
base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time

| stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time

How can I add the percentage in the query?
| timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time 
| stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time
| timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host
| addtotals 
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="Total", round('<<FIELD>>'/Total,2), '<<FIELD>>') ]

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time 
| stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time
| timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host
| addtotals 
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="Total", round('<<FIELD>>'/Total,2), '<<FIELD>>') ]
0 Karma

Joycetran
New Member

I never use Foreach before. thank you for giving this query. It works

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...