Splunk Search

AddColTotals & Percentage Column To Listed values

singhh4
Path Finder

Hey guys! So i have this search:

index="servers" | stats count by Delivery, VDC, Manageable | eval temp=Delivery."#".VDC | xyseries temp Manageable count| addtotals fieldname=Count| rex field=temp "(?<Delivery>[^#]+)#(?<VDC>.+)" | fields - temp | stats sum(Count) as "Total Per Delivery" list(*) as * by Delivery| fields Delivery "Total Per Delivery" Count VDC Yes No

Manageable contains "Yes" and "No" values that are listed horizontally. It gives me the following output:

Delivery      | Total Per Delivery | Count |   VDC    | Yes | No                                                                ---------------|--------------------|-------|----------|-----|------                                                                                                                                                   company1       |                 200|    150|    Group1|  100| 50                                                                                  `              |                    |     50|    Group2|   40| 10                                                                       ---------------|--------------------|-------|----------|-----|------                                                               company2       |                 100|    100|    Group3|   75|  25

I am trying to get something like the following:

Delivery      | Total Per Delivery | Count |   VDC    | Yes | No | %                                                                ---------------|--------------------|-------|----------|-----|----|---                                                                                                                                                   company1       |                 200|    150|    Group1|  100| 50 | 66%                                                                                                                             `              |                    |     50|    Group2|   40| 10 | 88%                                                                     ---------------|--------------------|-------|----------|-----|----|---                                                               company2       |                 100|    100|    Group3|   75| 25 | 75%                                                                              ---------------|--------------------|-------|----------|-----|----|---                                                               Total          |                 300|    250|          |  215| 85 | 86%

Where the percentage column is the value in Yes/Count. I have tried addcoltotals but because some columns are multi-valued columns it doesnt work. Then I tried mvexpand but it splits the columns in a strange way that i dont know how to handle.

0 Karma
1 Solution

jdonn_splunk
Splunk Employee
Splunk Employee

Very interesting question, and not a simple one to solve. To divide multivalve events, you will need to:
- use mvzip to combine the values per line
- use mvexpand to separate them into separate events
- use eval to perform division
- use mvcombine to put it all back together

This answer has 90% of that laid out for you - https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

You just have to put it back together on your own ;). But that should be fairly straight forward following the doc for it.

View solution in original post

jdonn_splunk
Splunk Employee
Splunk Employee

Very interesting question, and not a simple one to solve. To divide multivalve events, you will need to:
- use mvzip to combine the values per line
- use mvexpand to separate them into separate events
- use eval to perform division
- use mvcombine to put it all back together

This answer has 90% of that laid out for you - https://answers.splunk.com/answers/25653/mvexpand-multiple-multi-value-fields.html

You just have to put it back together on your own ;). But that should be fairly straight forward following the doc for it.

singhh4
Path Finder

You are a Splunk God! Thank you so much!

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...