https://community.splunk.com/t5/Splunk-Search/Top-percentage-out-of-total-events/m-p/33409#M7086 <P>When using the fields sidebar, I can see how often a field appears out of my total result set (ie Appears in 62% of results), and how often the top values of that field appear in the results. </P> <P>When I use the top command, I can see how often these values appear out of the total number of events that contain that field. </P> <P>How can I obtain statistics similar how the field sidebar presents them, as a percentage of the total result set? </P> <P><EM>In my use case I have UserAgent split out to multiple fields and want to know what are the top UserAgents across our total traffic.</EM></P> Fri, 15 Feb 2013 00:33:36 GMT Yancy 2013-02-15T00:33:36Z https://community.splunk.com/t5/Splunk-Search/Top-percentage-out-of-total-events/m-p/33409#M7086 <P>When using the fields sidebar, I can see how often a field appears out of my total result set (ie Appears in 62% of results), and how often the top values of that field appear in the results. </P> <P>When I use the top command, I can see how often these values appear out of the total number of events that contain that field. </P> <P>How can I obtain statistics similar how the field sidebar presents them, as a percentage of the total result set? </P> <P><EM>In my use case I have UserAgent split out to multiple fields and want to know what are the top UserAgents across our total traffic.</EM></P> Fri, 15 Feb 2013 00:33:36 GMT https://community.splunk.com/t5/Splunk-Search/Top-percentage-out-of-total-events/m-p/33409#M7086 Yancy 2013-02-15T00:33:36Z https://community.splunk.com/t5/Splunk-Search/Top-percentage-out-of-total-events/m-p/33410#M7087 <P>Here are a couple working options to help with ideas (replace ... with your search):</P> <PRE><CODE>... | eventstats count AS total | stats first(total) AS total count AS c by UserAgent | eval perc=(c/total)*100 | fields - total | sort - perc | head 10 </CODE></PRE> <P>or</P> <PRE><CODE>... | eventstats count AS total | chart eval(count/first(total)) AS perc BY UserAgent | sort - perc </CODE></PRE> Fri, 15 Feb 2013 07:19:04 GMT https://community.splunk.com/t5/Splunk-Search/Top-percentage-out-of-total-events/m-p/33410#M7087 Ron_Naken 2013-02-15T07:19:04Z