Hi everybody!
My database has to many properties, but important properties to set in my Dashboard starting with "U" (U12A8_TARGETOBJECTSTORENAME, U1708_DOCUMENTTITLE, U1903_ARCHIVALDATE, U2A76_CMSEARCHSCHEMAVERSION, U2D52_ICNAUTORUN, U2E68_ICNCLASSNAME, U3975_TARGETOBJECTCLASSID............)
Currently in my Splunk dashboard, I created a "Bar Panel".
My search is:
* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE"
My result is perfect, but I prefer to have my result as a percentage, so I want to replace "Count" by "Percentage"...
So I have to replace count by total like:
percentage = ("U*" * 100) / TOTAL but I don't know how to do that with the "U*"
I define TOTAL like this:
* | stats count(U*) as U*, count(U1708_DOCUMENTTITLE) as TOTAL | transpose | rename column AS Property "row 1" AS Count | SORT -Count | search Property !="U1708_DOCUMENTTITLE"
Do you know how I can do that?
Thanx a lot for answers!
Try this search
* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage
Try this search
* | stats count(U*) as U* | transpose | rename column AS Property "row 1" AS Count | SORT -Count | eval total=if(Property !="U1708_DOCUMENTTITLE",Count,0) | eventstats sum(total) as total | eval Percentage=round(Count*100/total,2) | search Property !="U1708_DOCUMENTTITLE" | table Property Percentage
Hi Somesoni2
Thanx for your answer! That work fine but I have a little bug with the result, I search to correct it :
Splunk say that total is 1096 but it's 1068.
Thanx again!
Add this to the end
... | eval perc=tostring(round((Count*100)/Total, 2), "commas")."%"
Hi Sundareshr!
Thanx for your answer!