Splunk Search

How to calculate average and percentage for fields with only names?

ranjitbrhm1
Communicator

Good Day splunkers. I have a query where i want to calculate the number of times a name came on the field, the average times the name was used and the percentage of the name in the field. (The below is truncated for understanding)

splunkd 12,786  1.1%    
Apache#1    12,094  1.041%  
splunk-perfmon  11,788  1.015%  
java#3  11,684  1.006%  
rotatelogs  11,452  0.986%  
svchost#4   11,409  0.982%  
perl    11,078  0.954%  
emagent 10,821  0.931%  
Tomcat7 10,309  0.887%  
splunk-regmon   10,274  0.884%  

If the field values were numeric I could have counted and summed and created the avg. but when the field value names like above how do I go forward? I have done something similar once with eval but I can't seem to figure this out.
Thanks

0 Karma
1 Solution

TISKAR
Builder

Can you try this please:

<YourBaseSearch>| stats count by name | eventstats sum(count)  as tot | eval pers=round(100*count/tot,2).%

For avg you want calcul the avg by what?

View solution in original post

TISKAR
Builder

Can you try this please:

<YourBaseSearch>| stats count by name | eventstats sum(count)  as tot | eval pers=round(100*count/tot,2).%

For avg you want calcul the avg by what?

akarivaratharaj
Communicator

How to find out count and average of a text based field for every 1 minute of time span

0 Karma

FrankVl
Ultra Champion

Try something like this:

...your search here...
| eventstats count as namecount by name
| eventstats count as totalcount
| eval percentage=(namecount/totalcount)*100
| fieldformat percentage=percentage."%"
Get Updates on the Splunk Community!

Stay Connected: Your Guide to May Tech Talks, Office Hours, and Webinars!

Take a look below to explore our upcoming Community Office Hours, Tech Talks, and Webinars this month. This ...

They're back! Join the SplunkTrust and MVP at .conf24

With our highly anticipated annual conference, .conf, comes the fez-wearers you can trust! The SplunkTrust, as ...

Enterprise Security Content Update (ESCU) | New Releases

Last month, the Splunk Threat Research Team had two releases of new security content via the Enterprise ...