Splunk Search

Calculate totals and then sort based on a field and separate out results

New Member

accountId: 12345678

action: Test
publishId: 123 or 456
tile: Tile1

How can I get this result: [accountID that has a tile=* value divided by the total number of total accountId's returned sorted by publishId 123 and 456 ]? Not all accountId's will have a tile value.

Tags (1)
0 Karma


Try this -

your search that returns the events
| stats count(accountId) as CountAccounts count(tile) as CountTiles by publishId
| eval percent=round(100*CountTiles/CountAccounts,0)
0 Karma

New Member

Is CountTiles the total tile count...is that right? I'm looking for the number of accountId's that have tile= Not all accountId's have a tile value associated with it.

Also is there a way to just sort on the publishId so that I get only 2 results sorted by publishId? Again a wildcard.

publishId="*123 and publishId=*456

0 Karma
Get Updates on the Splunk Community!

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...

Ready, Set, SOAR: How Utility Apps Can Up Level Your Playbooks!

 WATCH NOW Powering your capabilities has never been so easy with ready-made Splunk® SOAR Utility Apps. Parse ...