https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246047#M73370 <P>How about this? Add up the total using eventstats and then calculate the percentage for each row. </P> <PRE><CODE>| gentimes start=-500 | eval session_id=random() % 500 | eval device_id = random() % 10 | stats dc(session_id) AS unique_sessions by device_id | eventstats sum(unique_sessions) AS total | eval percent=round((unique_sessions/total)*100,2) | table device_id unique_sessions percent </CODE></PRE> Wed, 11 May 2016 15:29:21 GMT Jeremiah 2016-05-11T15:29:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246046#M73369 <P>I'm aware of a number of questions on here dealing with percents, including: <A href="https://answers.splunk.com/answers/120424/how-to-display-percentage-of-total.html">https://answers.splunk.com/answers/120424/how-to-display-percentage-of-total.html</A></P> <P>But I can't figure out how to apply it to my question. </P> <P>I have browser logs of site sessions, and want to report the % breakdown by device type. </P> <P>This search gets me a table of device totals (by distinct sessions), but how do i make it a %?</P> <PRE><CODE>eventtype=pageactions tag=external_traffic session_id=* | fillnull value=blank devicetype | stats dc(session_id) as unique_sessions by devicetype | table devicetype unique_sessions | addtotals row=f col=t labelfield=devicetype label=total </CODE></PRE> <P>Actually, ideally I'd like to have two columns (both as %) showing the % of distinct events and the % of all events. That way I can see both what device our visitors are using and if one device is causing more traffic.</P> <P>I can do that from here (if i could just divide by total)</P> <PRE><CODE>eventtype=pageactions tag=external_traffic session_id=* | fillnull value=blank devicetype | stats dc(session_id) as unique_sessions, count as event_counts by devicetype | table devicetype unique_sessions event_counts | addtotals row=f col=t labelfield=devicetype label=total </CODE></PRE> Wed, 11 May 2016 15:20:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246046#M73369 ra01 2016-05-11T15:20:19Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246047#M73370 <P>How about this? Add up the total using eventstats and then calculate the percentage for each row. </P> <PRE><CODE>| gentimes start=-500 | eval session_id=random() % 500 | eval device_id = random() % 10 | stats dc(session_id) AS unique_sessions by device_id | eventstats sum(unique_sessions) AS total | eval percent=round((unique_sessions/total)*100,2) | table device_id unique_sessions percent </CODE></PRE> Wed, 11 May 2016 15:29:21 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246047#M73370 Jeremiah 2016-05-11T15:29:21Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246048#M73371 <P>whoa! thanks. </P> Wed, 11 May 2016 15:33:47 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percent-from-distinct-count/m-p/246048#M73371 ra01 2016-05-11T15:33:47Z