Splunk Search

Eval results compared to Total counts

jon_marcum
New Member

I would like to display all Bot and Crawler activity compared to the total amount of events.

index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic)
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic)
| top WebTraffic

This provides a clear display of my Bots and Crawlers count but I would like to show what percentage the counts represent in comparison to all activity within the same time. For example per hour, my Bots are around 5000 events with Crawlers around 10,000, I'm simply looking for a way to show those numbers next to the total 100,000 of activity for the same hour.

Any thoughts on how to make this happen are appreciated.

Tags (1)
0 Karma
1 Solution

DMohn
Motivator

Try this:

index="Web"
| eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users")
| stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count
| eval bot_percent=round((bot_count/total_count)*100,2)
| eval crawler_percent=round((crawler_count/total_count)*100,2)
| table total_count, bot_count, bot_percent, crawler_count, crawler_percent

View solution in original post

0 Karma

DMohn
Motivator

Try this:

index="Web"
| eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users")
| stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count
| eval bot_percent=round((bot_count/total_count)*100,2)
| eval crawler_percent=round((crawler_count/total_count)*100,2)
| table total_count, bot_count, bot_percent, crawler_count, crawler_percent
0 Karma

jon_marcum
New Member

That's perfect, thanks for the help.

0 Karma

soskaykakehi
Path Finder

Hi @jon_marcum

How about this.

index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic) 
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic) 
| bin _time span=1h
| top WebTraffic by _time
| chart avg(count) as count, avg(percent) as percent over _time by WebTraffic
| addtotals "count: WebTraffic" "count: Bots" "count: Crawlers"
| fields _time "count: WebTraffic" "count: Bots" "count: Crawlers" Total "percent: Bots" "percent: Crawlers"

I hope this would be some of help.

0 Karma
Get Updates on the Splunk Community!

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more with ITSI’s ...

Accelerate Service Onboarding, Decomposition, Troubleshooting - and more! Faster Time to ValueManaging and ...

New Release | Splunk Enterprise 9.3

Admins and Analyst can benefit from:  Seamlessly route data to your local file system to save on storage ...

2024 Splunk Career Impact Survey | Earn a $20 gift card for participating!

Hear ye, hear ye! The time has come again for Splunk's annual Career Impact Survey!  We need your help by ...