https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287938#M87160 <P>Try something like this</P> <PRE><CODE>index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2) | table _time id count percentage </CODE></PRE> Tue, 12 Apr 2016 19:32:35 GMT somesoni2 2016-04-12T19:32:35Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287936#M87158 <P>Hey.</P> <P>I'm quite new with Splunk and learning for the moment. I need to show a table with " Time id count percentage "<BR /> For the last 15 days, I need to know the count of backend calls per id for each day.<BR /> I already extracted the Ids from a json file and now just need to show them as the way I described.</P> <P>I'm trying some things I only have this search:</P> <PRE><CODE>index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |timechart span=1d count by asset_data{}.id </CODE></PRE> <P>but it doesn't show me what I want. It just shows a table with field time and the name of each asset id in other field with the counts of each search on backend like this:</P> <PRE><CODE>time id12345 1269785 id9874 4/11 85 29 5 4/12 67 35 7 </CODE></PRE> Tue, 12 Apr 2016 17:44:19 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287936#M87158 guillecasco 2016-04-12T17:44:19Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287937#M87159 <P>It'd help if you provided some sample data along with a sketch of what your results table should look like.</P> Tue, 12 Apr 2016 19:29:18 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287937#M87159 martin_mueller 2016-04-12T19:29:18Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287938#M87160 <P>Try something like this</P> <PRE><CODE>index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2) | table _time id count percentage </CODE></PRE> Tue, 12 Apr 2016 19:32:35 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287938#M87160 somesoni2 2016-04-12T19:32:35Z https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287939#M87161 <P>I missunderstood the question. Didn't have to put 15 rows for the 15 last days, Just look up in the logs of the last 15 days and extract that information. So final query (With your help somesoni2) is</P> <PRE><CODE>index=updtr_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |stats count by asset_data{}.id | rename asset_data{}.id as id|eventstats sum(count) as total| eval percentage=round(count*100/total) |table id count percentage </CODE></PRE> <P>thank you!</P> Tue, 12 Apr 2016 19:49:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-edit-my-search-to-show-the-count-and-percentage-per-id/m-p/287939#M87161 guillecasco 2016-04-12T19:49:46Z