topic Re: How do you tabulate a percentage of field value in a table? in Splunk Search

How do you tabulate a percentage of field value in a table?

DEAD_BEEF — Sun, 02 Dec 2018 16:48:44 GMT

My search shows each website category and the number of times each category was visited. What I would like to create is a table that shows the percentage of all events by category rather than the count. I don't know why, but I'm getting no results found with my existing SPL.

sample data

category      count
streaming     50
reference     13
social media  150
gaming        37

desired output

category      percentage
streaming     25.0
reference     6.5
social media  75.0
gaming        18.5

current SPL

index=web
| stats count as grand_total
| stats count by category as cat_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage

Re: How do you tabulate a percentage of field value in a table?

niketn — Sun, 02 Dec 2018 17:11:08 GMT

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage

Re: How do you tabulate a percentage of field value in a table?

DEAD_BEEF — Sun, 02 Dec 2018 17:23:02 GMT

Exactly what I was looking for. I didn't think of using the value from stats and passing it to eventstats. Thank you!!

Re: How do you tabulate a percentage of field value in a table?

becksyboy — Wed, 22 Jun 2022 08:49:46 GMT

Thanks, just what i was looking for.