Splunk Enterprise Security

Percentage of Indexes’ logs in 24 hours.

SabariRajanT
Path Finder

Can someone help me to identify Percentage of Indexes’ logs in 24 hours.?

I have pulled using count like this :index=* earliest=-24h@h latest=now | stats count by index

But need this in Percentage.

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
index=* earliest=-24h@h latest=now 
| stats count by index
| eventstats sum(count) as total
| eval percent=round((count * 100) / total, 2)
| fields - total

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
index=* earliest=-24h@h latest=now 
| stats count by index
| eventstats sum(count) as total
| eval percent=round((count * 100) / total, 2)
| fields - total
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...