Splunk Search

Display table along with percentage

ncbshiva
Communicator

Hi

I need to display table along with percentage

This is my search query : source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | chart count over DS_CLIENTE by DS_STATUS_TRIAGEM

This is my table

DS_CLIENTE Aprovado Garantia Reparo Sucata
Contractor1 11509 1882 21651 323
Contractor2 1 0 5 0

I need to display the same table along with percentage.
This is just example
DS_CLIENTE Aprovado Garantia Reparo Sucata
Contractor1 11509(65.98) 1882(32.86) 21651(94.34) 323(29.65)
Contractor2 1 0 5 0

Please help me in this.

Thanking you in advance

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try this

source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | stats count by DS_CLIENTE, DS_STATUS_TRIAGEM | eventstats sum(count) as Total by DS_CLIENTE| eval count=count."(".round(count*100/Total,2)."%)"| chart first(count) as count over DS_CLIENTE by DS_STATUS_TRIAGEM| fillnull value="0(0.00%)"

View solution in original post

somesoni2
Revered Legend

Try this

source=foo | fields DS_CLIENTE,DS_STATUS_TRIAGEM,DT_TRIAGEM,PROJETO| where PROJETO="Contratada" | stats count by DS_CLIENTE, DS_STATUS_TRIAGEM | eventstats sum(count) as Total by DS_CLIENTE| eval count=count."(".round(count*100/Total,2)."%)"| chart first(count) as count over DS_CLIENTE by DS_STATUS_TRIAGEM| fillnull value="0(0.00%)"

ncbshiva
Communicator

yes 100% for each contractor

0 Karma

somesoni2
Revered Legend

How is the percentage calculated, 100% for each contractor?

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...

Updated Data Management and AWS GDI Inventory in Splunk Observability

We’re making some changes to Data Management and Infrastructure Inventory for AWS. The Data Management page, ...