Splunk Search

How to calcaulate a percentage based on the number of days, which are over 2 days old?

Sfry1981
Communicator

I have a bunch of values for number of days but I want to write a query that shows the percentage of results that are over 2 days old. I have posted an example below

number of days
1
3
5
6
2

Currently I have Base search | eval percentage = if((days> 2), 1, 0) so this gives me a columns of 1's and 0's but how can I say 0's have this much percentage and 1's have this much percentage based on the joint total of 100%?

Thanks

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this

Base search | eval gt2= if((days> 2), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2)

Sfry1981
Communicator

Thanks @somesoni2. I have been testing and found that it does not come to a full 100% so if i change the search too Base search | eval gt2= if((days< 3), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) then it shows only 54% so its missing about 8% on the figure. When i do my search as Base search | eval gt2= if((days< 1000), 1, 0) | stats count as Total sum(gt2) as gt2 | eval percentage=round(gt2*100/Total,2) it shows as 91.67%. Do you kn ow what the issue is?

0 Karma

Sfry1981
Communicator

Ignore me @somesoni2 as there were a couple of values missing in the columns so all correct

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...