Here's what I have:
base search| stats count as spamtotal by spam
This gives me:
spam / spamtotal
original / 5
crispy / 8
What I want is:
spam / eggs / count / spamtotal / ratio
original / AAA / 2 / 5 / 0.4
original / BBB / 1 / 5 ** / 0.2
crispy / CCC / 2 / **8 / 0.25
crispy / DDD / 2 / 8 / 0.25
Basically it's a ratio of count to the spamtotal, or a dynamic impact percentage. I feel like this should be easy. But
stats and eventstats isn't working for me so far. Thank you.
As suggested in another thread, using eval in a count instead of 'by' clause worked for me:
search msgType=*| timechart span=1h count(eval(msgType=="IN")) as IN, count(eval(msgType="OUT")) as OUT | eval ratio=OUT/IN
Did the answer below solve your problem? If so, please resolve this post by approving it!
If your problem is still not solved, keep us updated so that someone else can help ya. Thanks for posting!
Try something like this...
base search | stats count as spamsubtotal by spam eggs | eventstats sum(spamsubtotal) as spamtotal by spam | eval ratio = round(spamsubtotal/spamtotal,2) | rename spamsubtotal as count
Hmm, this table is doing what I described. Unfortunately, I did not ask my question correctly. Sorry!
I'm really hoping to use tstats with something like fillnull so I can compare counts of one field with the total counts of a different field. Right now splunk is only taking the fields that have counts in common and I don't know if there's an easy argument to choose a field to get totals from.