Splunk Search

How do I present my search results as a percentage instead of a count?

splunkids75
New Member

Hi everybody!

My database has to many properties, but important properties to set in my Dashboard starting with "U" (U12A8_TARGETOBJECTSTORENAME, U1708_DOCUMENTTITLE, U1903_ARCHIVALDATE, U2A76_CMSEARCHSCHEMAVERSION, U2D52_ICNAUTORUN, U2E68_ICNCLASSNAME, U3975_TARGETOBJECTCLASSID............)

Currently in my Splunk dashboard, I created a "Bar Panel".

My search is:

* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE"

alt text
My result is perfect, but I prefer to have my result as a percentage, so I want to replace "Count" by "Percentage"...

So I have to replace count by total like:

 percentage = ("U*" * 100) / TOTAL but I don't know how to do that with the "U*"

I define TOTAL like this:

* | stats count(U*) as U*, count(U1708_DOCUMENTTITLE) as TOTAL | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE"

Do you know how I can do that?

Thanx a lot for answers!

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try this search

* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Try this search

* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage
0 Karma

splunkids75
New Member

Hi Somesoni2

Thanx for your answer! That work fine but I have a little bug with the result, I search to correct it :
Splunk say that total is 1096 but it's 1068.

Thanx again!

0 Karma

sundareshr
Legend

Add this to the end

... | eval perc=tostring(round((Count*100)/Total, 2), "commas")."%"
0 Karma

splunkids75
New Member

Hi Sundareshr!

Thanx for your answer!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...