Splunk Search

Get % values out of a query

angersleek
Path Finder

I have the following query. The key TEST_DECISION has 4x possible outcomes. CALL_FAILED, VALID, INVALID, NOT_CALLED.

ns=test* TEST_DECISION
PRODUCT IN (SAMPLE_123)
| timechart span=5m limit=0 count by TEST_DECISION

The output is as follows:

_time                             CALL_FAILED                 VALID             INVALID NOT_CALLED
2020-04-14T05:50:00.000-0700       11                           83                   7                  46
2020-04-14T05:55:00.000-0700       6                            60                   6                  42
2020-04-14T06:00:00.000-0700       8                            78                   19                 55
2020-04-14T06:05:00.000-0700       11                           86                   19                 59
2020-04-14T06:10:00.000-0700       10                           94                    17                    71
2020-04-14T06:15:00.000-0700       8                            67                    17                    63
2020-04-14T06:20:00.000-0700       2                            19                     4                    17

Is there a way I could show % instead? I only care about VALID and INVALID.
Thus I want to get the following instead.

For first row 100% will be 83(valid) + 7(invalid)

Thus I want to achieve following

VALID    INVALID
92.22%  7.77%

Please advice if there is a way I could achieve this. Thank you.

Tags (1)
1 Solution

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total

View solution in original post

skoelpin
SplunkTrust
SplunkTrust

Add this

| eval total= VALID+INVALID
| eval Valid_Percent=round(VALID/total,4)*100
| eval Invalid_Percent=round(INVALID/total,4)*100
| fields - total
Get Updates on the Splunk Community!

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...

Introducing the 2024 Splunk MVPs!

We are excited to announce the 2024 cohort of the Splunk MVP program. Splunk MVPs are passionate members of ...

Splunk Custom Visualizations App End of Life

The Splunk Custom Visualizations apps End of Life for SimpleXML will reach end of support on Dec 21, 2024, ...