Splunk Search

Calculate Percentage

gnovak
Builder

I've been going around in circles on this all day and at this point figured I would post my question here:

sourcetype="EPPWEB" source="/opt/log/dotblah/web_server/info.log" OR source="/opt/log/dotblah/*/web_server/info.log" WAT | dedup registrar | stats count(registrar) as numviewed by description,registry

This search produces a small table that looks kinda like this:

Description     Registry    numviewed
Billing Invoice     dotblah     3
Daily Auto Renewals dotblah     3
Billing Text        dotblah     14
Annual Report       dotblah     10

What I'm trying to do is create a percentage based on the numviewed values and a number displayed in a field. The field is:

actualcount     424

So I want to basically have a percent column showing the percent. So 3 out of 424 would be how many percent?

Description     Registry    numviewed  actualcount  percent
Billing Invoice     dotblah     3       424 
Daily Auto Renewals dotblah     3       424
Billing Text        dotblah     14      424
Annual Report       dotblah     10      424

I tried using eval at the end of this but it didn't do anything and showed no results:

sourcetype="EPPWEB" source="/opt/log/dotblah/web_server/info.log" OR source="/opt/log/dotblah/*/web_server/info.log" WAT | search description="*" | dedup registrar | stats count(registrar) as numviewed by description,registry | eval percent=(numviewed/registrycount)*100

How can i get the percentage I want?

Tags (1)
0 Karma

Ayn
Legend

First make sure you have the count value in a field, so you can include it in eval's calculations. By using eventstats you can do this without losing information that is needed later on in the search pipeline. Then do the eval stuff inline in your stats command. Like this:

sourcetype="EPPWEB" source="/opt/log/dotblah/web_server/info.log" OR source="/opt/log/dotblah/*/web_server/info.log" WAT search description="*" | dedup registrar | eventstats count by description,registry | stats sum(count) as numviewed,sum(eval(100*numviewed/actualcount)) as percent by description,registry

gnovak
Builder

actualcount is a static value that is currently in a lookup file

0 Karma

jonuwz
Influencer

Where does actualcount come from - can you calculate it - if so how ? post the search that gives you the value of actualcount

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...