https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387821#M171040 <P>I would like to display all Bot and Crawler activity compared to the total amount of events.</P> <P>index="Web" <BR /> | eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic) <BR /> | eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic) <BR /> | top WebTraffic</P> <P>This provides a clear display of my Bots and Crawlers count but I would like to show what percentage the counts represent in comparison to all activity within the same time. For example per hour, my Bots are around 5000 events with Crawlers around 10,000, I'm simply looking for a way to show those numbers next to the total 100,000 of activity for the same hour.</P> <P>Any thoughts on how to make this happen are appreciated.</P> Wed, 30 Sep 2020 00:41:03 GMT jon_marcum 2020-09-30T00:41:03Z https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387821#M171040 <P>I would like to display all Bot and Crawler activity compared to the total amount of events.</P> <P>index="Web" <BR /> | eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic) <BR /> | eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic) <BR /> | top WebTraffic</P> <P>This provides a clear display of my Bots and Crawlers count but I would like to show what percentage the counts represent in comparison to all activity within the same time. For example per hour, my Bots are around 5000 events with Crawlers around 10,000, I'm simply looking for a way to show those numbers next to the total 100,000 of activity for the same hour.</P> <P>Any thoughts on how to make this happen are appreciated.</P> Wed, 30 Sep 2020 00:41:03 GMT https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387821#M171040 jon_marcum 2020-09-30T00:41:03Z https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387822#M171041 <P>Hi @jon_marcum </P> <P>How about this.</P> <PRE><CODE>index="Web" | eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic) | eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic) | bin _time span=1h | top WebTraffic by _time | chart avg(count) as count, avg(percent) as percent over _time by WebTraffic | addtotals "count: WebTraffic" "count: Bots" "count: Crawlers" | fields _time "count: WebTraffic" "count: Bots" "count: Crawlers" Total "percent: Bots" "percent: Crawlers" </CODE></PRE> <P>I hope this would be some of help.</P> Tue, 28 May 2019 06:05:52 GMT https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387822#M171041 soskaykakehi 2019-05-28T06:05:52Z https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387823#M171042 <P>Try this:</P> <PRE><CODE>index="Web" | eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users") | stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count | eval bot_percent=round((bot_count/total_count)*100,2) | eval crawler_percent=round((crawler_count/total_count)*100,2) | table total_count, bot_count, bot_percent, crawler_count, crawler_percent </CODE></PRE> Tue, 28 May 2019 10:44:27 GMT https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387823#M171042 DMohn 2019-05-28T10:44:27Z https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387824#M171043 <P>That's perfect, thanks for the help.</P> Tue, 28 May 2019 13:29:53 GMT https://community.splunk.com/t5/Splunk-Search/Eval-results-compared-to-Total-counts/m-p/387824#M171043 jon_marcum 2019-05-28T13:29:53Z