Splunk Search

Capture the total number of requests before rendering the chart.

terryloar
Path Finder

I'm charting some events BY Host which gives me the correct counts for each host. I would like to also display a "% Total Requests" on each line, but can't figure out how to capture the total number of requests before renderng the chart. In other words, I need to be able to do:

Requests / Total Requests for each line in the table.

This is the current search, without the Total Requests:

/nepoc_access.log.1" | lookup dnslookup ip AS client_ip | rename host AS Host | chart count(Host) AS Requests, sum(eval(file_size/1000000000)) AS GBytes by Host | sort 100 -Requests

And the Results are:

Host    Requests    GBytes

1 host1 1382 0.023790
2 host2 1072 0.011972
3 host3 660 0.006896

Tags (1)
0 Karma

gkanapathy
Splunk Employee
Splunk Employee
/nepoc_access.log.1 
| lookup dnslookup ip AS client_ip
| rename host AS Host 
| chart count(Host) AS Requests,  sum(eval(file_size/1000000000)) AS GBytes by Host
| eventstats sum(Requests) as TotalRequests
| eval pctRequests=Requests/TotalRequests
| sort 100 -Requests

terryloar
Path Finder

Thanks, gkanapathy. It gave me just what I wanted.

0 Karma
Get Updates on the Splunk Community!

New Learning Videos on Topics Most Requested by You! Plus This Month’s New Splunk ...

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...

How I Instrumented a Rust Application Without Knowing Rust

As a technical writer, I often have to edit or create code snippets for Splunk's distributions of ...

Splunk Community Platform Survey

Hey Splunk Community, Starting today, the community platform may prompt you to participate in a survey. The ...