Splunk Search

How to calculate the percentages of the field values (yes/no) in a field?

pavanae
Builder

Hi I have a Splunk search as follows:

My search | table host_name, last_seen_in_24hours

which displays the result as follows
alt text
Now I'm trying to see the percentage of YES's and NO's in a pie chart.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Just add this to end of your search and select pie chart visualization

your current search | stats count by last_seen_in_24hours

View solution in original post

niketn
Legend

@pavanae, in case your hosts can have duplicate data for last_seen_in_24_hours, you would need to dedup or get latest value per host

<YourBaseSearch>
| stats last(last_seen_in_24_hours) as last_seen_in_24_hours by host
| stats count by last_seen_in_24_hours

Or

<YourBaseSearch>
| dedup host
| stats count by last_seen_in_24_hours
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"
0 Karma

somesoni2
SplunkTrust
SplunkTrust

Just add this to end of your search and select pie chart visualization

your current search | stats count by last_seen_in_24hours
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...