Splunk Search

Calculate % of each field as ratio?

Joycetran
New Member

I have the table:
_time Ip_1 Ip_2 Ip_3
a 36 40 31
b 37 39 21

I want to take the percentage of each IP instead count, like:
a 0.33 0.37 0.28
The table above From the query:
base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time

| stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time

How can I add the percentage in the query?
| timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time 
| stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time
| timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host
| addtotals 
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="Total", round('<<FIELD>>'/Total,2), '<<FIELD>>') ]

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

base search | | stats dc(sid) AS distinct_search_count by provenance, mode, app, type, user, host, _time 
| stats sum(distinct_search_count) as total_distinct_search_count by provenance, mode, app, type, user, host, _time
| timechart minspan=10s partial=false Max(total_distinct_search_count) as search_count by host
| addtotals 
| foreach * [| eval "<<FIELD>>"=if("<<FIELD>>"!="Total", round('<<FIELD>>'/Total,2), '<<FIELD>>') ]
0 Karma

Joycetran
New Member

I never use Foreach before. thank you for giving this query. It works

0 Karma
Get Updates on the Splunk Community!

Why You Can't Miss .conf25: Unleashing the Power of Agentic AI with Splunk & Cisco

The Defining Technology Movement of Our Lifetime The advent of agentic AI is arguably the defining technology ...

Deep Dive into Federated Analytics: Unlocking the Full Power of Your Security Data

In today’s complex digital landscape, security teams face increasing pressure to protect sprawling data across ...

Your summer travels continue with new course releases

Summer in the Northern hemisphere is in full swing, and is often a time to travel and explore. If your summer ...