https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618283#M214880 <LI-CODE lang="markup">&lt;base_search&gt; | stats sum(bytes) AS bytes by app | eventstats sum(bytes) AS total_bytes | eval percentage=ROUND((bytes/total_bytes)*100, 2)." %" | eval app_size_gb=ROUND(bytes/1073741824, 2) | eval total_size_gb=ROUND(total_bytes/1073741824, 2) | table app app_size_gb total_size_gb percentage</LI-CODE> Tue, 25 Oct 2022 20:18:50 GMT johnhuang 2022-10-25T20:18:50Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618277#M214877 <P>I am having a brain fart on trying to figure out how to find the total bytes per application and the the percent of each app by total bytes.</P><P>For example:</P><TABLE border="1" width="100%"><TBODY><TR><TD width="33.333333333333336%" height="25px">app</TD><TD width="33.333333333333336%" height="25px">bytes in GB</TD><TD width="33.333333333333336%" height="25px">percentage</TD></TR><TR><TD width="33.333333333333336%" height="25px">SSL</TD><TD width="33.333333333333336%" height="25px">300GB</TD><TD width="33.333333333333336%" height="25px">23%</TD></TR><TR><TD width="33.333333333333336%" height="25px">DNS</TD><TD width="33.333333333333336%" height="25px">100GB</TD><TD width="33.333333333333336%" height="25px">13%</TD></TR><TR><TD>etc</TD><TD>etc</TD><TD>etc</TD></TR></TBODY></TABLE><P>&nbsp;</P><P>Current search is this:</P><P>&nbsp;</P><LI-CODE lang="markup">index=foo | eventstats sum(bytes) as total_bytes | stats sum(bytes) as total first(total_bytes) as total_bytes by app | eval CompliancePct=round(total/total_bytes,2)</LI-CODE><P>&nbsp;</P><P>Any help would be appreciated</P> Tue, 25 Oct 2022 19:55:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618277#M214877 jwalzerpitt 2022-10-25T19:55:59Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618283#M214880 <LI-CODE lang="markup">&lt;base_search&gt; | stats sum(bytes) AS bytes by app | eventstats sum(bytes) AS total_bytes | eval percentage=ROUND((bytes/total_bytes)*100, 2)." %" | eval app_size_gb=ROUND(bytes/1073741824, 2) | eval total_size_gb=ROUND(total_bytes/1073741824, 2) | table app app_size_gb total_size_gb percentage</LI-CODE> Tue, 25 Oct 2022 20:18:50 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618283#M214880 johnhuang 2022-10-25T20:18:50Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618284#M214881 <P>TYVM!</P> Tue, 25 Oct 2022 20:22:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-the-percentage-of-total-bytes-by-app/m-p/618284#M214881 jwalzerpitt 2022-10-25T20:22:37Z