https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138155#M37914 <P>Hey,</P> <P>i tried this out, but Splunk tells me "no results found" after adding the eventstats &amp; eval command.</P> Tue, 12 Nov 2013 13:05:59 GMT HeinzWaescher 2013-11-12T13:05:59Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138153#M37912 <P>Hi,</P> <P>I have a search like this:</P> <P><STRONG>search... | fields + user, country| stats dc(user) AS Users by country | sort - Users</STRONG></P> <P>The result is a table like this:</P> <P>Country A - 1000</P> <P>Country B - 500</P> <P>Country C - 500</P> <P>Is there an easy way to display the share per country in %?</P> <P>Country A - 50</P> <P>Country B - 25</P> <P>Country C - 25</P> Tue, 12 Nov 2013 09:26:33 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138153#M37912 HeinzWaescher 2013-11-12T09:26:33Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138154#M37913 <P>You can calculate a total distinct count and then divide your Users value by this to get a percentage.</P> <PRE><CODE>search... | fields + user, country| eventstats dc(user) as totalcount | stats dc(user) AS Users by country | eval countrypercent=Users/totalcount*100 | sort - Users </CODE></PRE> Tue, 12 Nov 2013 11:04:57 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138154#M37913 Ayn 2013-11-12T11:04:57Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138155#M37914 <P>Hey,</P> <P>i tried this out, but Splunk tells me "no results found" after adding the eventstats &amp; eval command.</P> Tue, 12 Nov 2013 13:05:59 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138155#M37914 HeinzWaescher 2013-11-12T13:05:59Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138156#M37915 <P>Neither eventstats nor eval filter events in any way so I suspect you're doing some other error. What does your search look like now?</P> Tue, 12 Nov 2013 13:15:41 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138156#M37915 Ayn 2013-11-12T13:15:41Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138157#M37916 <P>It looks like this now:</P> <P>search...| fields + user</P> <P>| eventstats dc(user) as totalcount<BR /> | stats dc(user) AS Users by Country<BR /> | eval countrypercent=Users/totalcount*100</P> <P>This results in the original table including the total counts per Country. I also tried out to find the entries for totalcount with "| table totalcount". But there are no results</P> Tue, 12 Nov 2013 13:44:37 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138157#M37916 HeinzWaescher 2013-11-12T13:44:37Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138158#M37917 <P>The corrected query is:</P> <PRE><CODE>search... | fields + user, country| eventstats dc(user) as totalcount | stats dc(user) AS Users by country, totalcount | eval countrypercent=Users/totalcount*100 | sort - Users </CODE></PRE> <P>The problem with the original query is that it didn't pass totalcount in the stats statement.<BR /> So the percentage could not be calculated.</P> Thu, 12 Jun 2014 17:32:42 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138158#M37917 sansay 2014-06-12T17:32:42Z https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138159#M37918 <P>I downvoted this post because refined query in later post solves the problem.</P> Fri, 02 Dec 2016 17:16:42 GMT https://community.splunk.com/t5/Splunk-Search/Stats-as-Percentages-Of-Total/m-p/138159#M37918 GeorgeStarkey 2016-12-02T17:16:42Z