Splunk Search

How do you get multiple percentage results in one table?

stephenmeyers
Explorer

I would like to report the total number games played per team, and the percentage of wins, losses, and ties by team. Example data:

team=A result=win
team=A result=loss
team=B result=win
team=B result=win
team=B result=tie
team=A result=loss
team=B result=win

Desired Splunk output:

Team    Games Played    Win %    Loss %    Tie %
A       3               33%      66%       0%
B       4               75%      0%        25%
Tags (3)
0 Karma
1 Solution

vnravikumar
Champion

Hi @stephenmeyers

Try this, considered column name asTeam,Result in index

your query...| stats count as played, count(eval(Result=="win")) as win,count(eval(Result=="loss")) as loss,count(eval(Result=="tie")) as tie by Team 
| eval loss=round(loss/played*100,2)."%", win=round(win/played*100,2)."%", tie=round(tie/played*100,2)."%" 
| rename played as "Game Played", win as "Win%", loss as "Loss%", tie as "Tie%"

alt text

View solution in original post

vnravikumar
Champion

Hi @stephenmeyers

Try this, considered column name asTeam,Result in index

your query...| stats count as played, count(eval(Result=="win")) as win,count(eval(Result=="loss")) as loss,count(eval(Result=="tie")) as tie by Team 
| eval loss=round(loss/played*100,2)."%", win=round(win/played*100,2)."%", tie=round(tie/played*100,2)."%" 
| rename played as "Game Played", win as "Win%", loss as "Loss%", tie as "Tie%"

alt text

Get Updates on the Splunk Community!

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...

Welcome to the Splunk Community!

(view in My Videos) We're so glad you're here! The Splunk Community is place to connect, learn, give back, and ...

Tech Talk | Elevating Digital Service Excellence: The Synergy of Splunk RUM & APM

Elevating Digital Service Excellence: The Synergy of Real User Monitoring and Application Performance ...