Splunk Search

Use an eval statement to find a percentage

jregexsaurus
Engager

index=proxy sourcetype=bar
| stats count by blockedAction
| addtotals fieldname=grandTotal
| eval percentBlocked = round((blockedAction/grandTotal)*100,1)

I'm trying to show the amount blocked as a percent of total traffic. BlockedAction is a field that was created.

Labels (2)
0 Karma
1 Solution

bowesmana
SplunkTrust
SplunkTrust

The simplest way is to use the top command

index=proxy sourcetype=bar
| top 0 blockedAction

but you can do this other ways, such as 

index=proxy sourcetype=bar
| stats count by blockedAction
| eventstats sum(count) as grandTotal
| eval percentBlocked = round((count/grandTotal)*100,1)
| fields - grandTotal

Hope this helps

View solution in original post

richgalloway
SplunkTrust
SplunkTrust

It would be helpful to know what results you get from that query, but I expect you get no results.  If you do get results then they're likely to be inaccurate because the blockedAction field is a label rather than a count.

Try this variation on your query.

index=proxy sourcetype=bar
| stats count as grandTotal, sum(eval(blockedAction="blocked")) as blockedCount
| eval percentBlocked = round((blockedCount/grandTotal)*100,1)
---
If this reply helps you, Karma would be appreciated.
0 Karma

bowesmana
SplunkTrust
SplunkTrust

The simplest way is to use the top command

index=proxy sourcetype=bar
| top 0 blockedAction

but you can do this other ways, such as 

index=proxy sourcetype=bar
| stats count by blockedAction
| eventstats sum(count) as grandTotal
| eval percentBlocked = round((count/grandTotal)*100,1)
| fields - grandTotal

Hope this helps

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...