https://community.splunk.com/t5/Splunk-Search/How-to-find-top-events-contributing-to-a-total-of-X-of-the/m-p/288365#M175710 <P>Hi, I can find the top events but I want to see all those events that are contributing say 80% of the total. e.g. there are 25k events and the top 10 events contribute to 96% of the total. I want to see the only events that contribute to 80% of the total rather than 96% as retrieved in the results. I have read related questions/answers but couldn't get a clue how to do it. Anyone please?</P> Tue, 07 Feb 2017 08:51:55 GMT dkikan 2017-02-07T08:51:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-top-events-contributing-to-a-total-of-X-of-the/m-p/288365#M175710 <P>Hi, I can find the top events but I want to see all those events that are contributing say 80% of the total. e.g. there are 25k events and the top 10 events contribute to 96% of the total. I want to see the only events that contribute to 80% of the total rather than 96% as retrieved in the results. I have read related questions/answers but couldn't get a clue how to do it. Anyone please?</P> Tue, 07 Feb 2017 08:51:55 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-top-events-contributing-to-a-total-of-X-of-the/m-p/288365#M175710 dkikan 2017-02-07T08:51:55Z https://community.splunk.com/t5/Splunk-Search/How-to-find-top-events-contributing-to-a-total-of-X-of-the/m-p/288366#M175711 <P>Give this a try. Assuming there is a unique identifier field call <CODE>identifier</CODE> based on which the top is calculated.</P> <PRE><CODE>index=foo sourcetype=bar [ search index=foo sourcetype=bar | stats count by identifier | sort 0 -count | eventstats sum(count) as total | eval perc=round(count*100/total) | accum perc | where perc&lt;=80] </CODE></PRE> Tue, 07 Feb 2017 15:45:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-find-top-events-contributing-to-a-total-of-X-of-the/m-p/288366#M175711 somesoni2 2017-02-07T15:45:07Z