Hi, I wonder whether someone may be able to help me please.
With some help along the way I've written the query below:
index=main auditSource=frontend auditType=Survey detail.overall!="None"
| replace frontend with "Overall Satisfaction"
| rename detail.overall As "Rating"
| replace 1 with "Very Satisfied", 2 with "Satisfied", 3 with "Neither", 4 with "Dissatisfied", 5 with "Very Dissatisfied"
| chart count by Rating |eval "Rating Mark"=case(Rating="Very Satisfied", 100, Rating="Satisfied", 75 , Rating="Neither", 50, Rating="Dissatisfied", 25, Rating="Very Dissatisfied", 0 , 1=1, 0)
| rename count as "Total No Of Replies"
| eval "Rating Calculation"='Total No Of Replies' * 'Rating Mark'
| table "Rating", "Total No Of Replies", "Rating Mark", "Rating Calculation"
| addcoltotals labelfield=Rating label="Total"
| eval Weighted Rating =if(Rating=="Total",tostring(round('Rating Calculation' *1 / 'Total No Of Replies',1)) + "%",null())
| eval Rating=(Rating) | eval sort_field=case(Rating=="Very Satisfied",1,Rating=="Satisfied",2,Rating=="Neutral",3,Rating=="Dissatisfied",4,Rating=="Very Dissatisfied",5)
| sort sort_field
| fields "Rating", "Total No Of Replies", "Rating Mark", "Weighted Rating"
What I'd like to do is display only the 'Total' row.
I found a link [here][1] and tried the 'fields + Total' and 'where ser=Total' solutions but I've been unable to get these to work.
I just wondered whether someone may be able to look at this please and offer some guidance on how I may achieve this.
Many thanks and kind regards
Chris
[1]: https://answers.splunk.com/answers/206455/how-do-display-only-the-total-row.html
↧