https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354344#M104895 <P>Perfect!</P> <P>Thanks, I knew it was something to do with eventstats, but couldn't get it to work!</P> Tue, 08 Aug 2017 14:33:40 GMT ewanbrown 2017-08-08T14:33:40Z https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354342#M104893 <P>Hi,</P> <P>I have a simple search that uses top to get the top 10 countries:</P> <PRE><CODE> search ........ | top Country </CODE></PRE> <P>It will give the top 10 Countries and percentage.</P> <P>How can I get the same, but look at the top 10 Countries by unique users?</P> <P>This :</P> <PRE><CODE> search ..... | stats dc(ID) as users by Country | sort users desc limit=10 </CODE></PRE> <P>Will give me the top 10, but not show the % for each.</P> <P>Is there a way to do this?</P> <P>Thanks</P> Tue, 08 Aug 2017 13:07:58 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354342#M104893 ewanbrown 2017-08-08T13:07:58Z https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354343#M104894 <P>try this:</P> <PRE><CODE> search ..... | eventstats dc(ID) as totalUsers|stats max(totalUsers) as totalUsers dc(ID) as users by Country | sort users desc limit=10|eval percentage=users/totalUsers*100|fields - totalUsers </CODE></PRE> Tue, 08 Aug 2017 13:26:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354343#M104894 cmerriman 2017-08-08T13:26:19Z https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354344#M104895 <P>Perfect!</P> <P>Thanks, I knew it was something to do with eventstats, but couldn't get it to work!</P> Tue, 08 Aug 2017 14:33:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-show-the-percentage-of-unique-values/m-p/354344#M104895 ewanbrown 2017-08-08T14:33:40Z