Splunk Search

How to chart a percentage from derived search result?

annalwins
Engager

I am new to splunka and have a question on charting percentage field that is derived from search/query result.

Splunk indexed logs:
2013-10-11 17:46:22,539 INFO [com.xxx.yyy] score=891 url_id=200

I would like to chart a % of urls whose score < 100.

I use below query to get list of score count.
host="abc" AND com.xxx.yyy "score" | chart count by score

How can I calculate a percentage of score <100 using splunk?

Tags (1)
0 Karma
1 Solution

somesoni2
Revered Legend

Try below query

host="abc" AND com.xxx.yyy | stats count(eval(score<100)) as CountLess, count as Total by date_hour| eval perc=CountLess*100/Total | fields date_hour,perc

View solution in original post

somesoni2
Revered Legend

Try below query

host="abc" AND com.xxx.yyy | stats count(eval(score<100)) as CountLess, count as Total by date_hour| eval perc=CountLess*100/Total | fields date_hour,perc

Get Updates on the Splunk Community!

New in Observability Cloud - Explicit Bucket Histograms

Splunk introduces native support for histograms as a metric data type within Observability Cloud with Explicit ...

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...