topic Re: Top to a sum in Splunk Search

Top to a sum

jrodriguezap — Tue, 01 Oct 2013 00:59:19 GMT

Hello!
I try to make the sum of a field, but then need to get the percentage occupied by each of the first 4, and% occupying all others, ie get something like this:

**Service**    **SumMB**        **percent**
  HHTP            90               25.71
  HTTPS           85               22.45
  DNS             81               21.09
  SMTP            70               16.90
  Otros           23               13.85

I tried something like this, but that would be missing something but, as you could?

SEARCH | stats sum(MB) AS SumMB by service | top SumMB otherstr="Others"

Thank you for your attention.
:)

Re: Top to a sum

lukejadamec — Tue, 01 Oct 2013 01:13:04 GMT

In your question you ask for the sum of the first 4 with a percent, and then a percent of the others, but in your example you show the sum and percent for all 5. Your goal is not clear.
The question: "I tried something like this, but that would be missing something but, as you could?" does not compute. Can you review this question, please.

Re: Top to a sum

jrodriguezap — Tue, 01 Oct 2013 01:44:38 GMT

Sorry for the confusion, but the result I'm trying to get is the one show as a table. I hope you understand.

Re: Top to a sum

HiroshiSatoh — Tue, 01 Oct 2013 05:07:23 GMT

"Others" is displayed if I assume it "useother=true". However, I think that this isn't the result that you expect.

SEARCH | stats sum(MB) AS SumMB by service | top SumMB useother=true otherstr="Others"

I think that it is necessary to calculate percent by oneself.

comment

When there is little number, you may demand total by a subsearch.

Re: Top to a sum

jrodriguezap — Tue, 01 Oct 2013 18:05:16 GMT

Your response and your logic are excellent!
Thank you very much HiroshiSatoh!