How can I create a percentage field in a table based on the count

Follow

Greg Mantzaris

• May 04, 2020 07:19
• Edited

Say I am parsing a file which contains response codes as "response_code" and response times as "response_time".

I then want to visualise this in a table with:

| count avg(response_time) as Average, count as ResponseCount by response_code

I would also like to know what percentage of all transactions in the selected timeframe each count of "response_code" accounts for and add that as a field showing that percentage.

I don't know what the response_code values could be for the query as they are dynamic.

eg:

Imagine I have data like:

response_code     response_time
1                 100
2                 150
1                 300
1                 200

I would want the output to look like:

response_code   Average   ResponseCount  PercentageOfTransactions
1              200      3              75
2              150      1              25

In splunk I would do this with eventstats to calculate the total and the percentage then report the percentage as values(PercentageOfTransactions)

0

• 

  Greg Mantzaris

  • May 14, 2020 23:07

  Perfect Rick Jury.   Thanks!   Worked exactly as I wanted.

  1

  Comment actions Permalink
• 

  Rick Jury

  • May 14, 2020 21:28

  hi Greg,

   

  you can do eventstats in sumo just a different way.

   

  | avg(response_time) as Average, count as ResponseCount by response_code

  | total ResponseCount as totalresponses

  | (ResponseCount / totalresponses) * 100 as PercentageOfTransactions
  | sort PercentageOfTransactions
  | fields -totalresponses

   

  you could also use the format operator if you want to display it as a percentage with %

  0

  Comment actions Permalink

Please sign in to leave a comment.