Splunk Search

Eval results compared to Total counts

jon_marcum
New Member

I would like to display all Bot and Crawler activity compared to the total amount of events.

index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic)
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic)
| top WebTraffic

This provides a clear display of my Bots and Crawlers count but I would like to show what percentage the counts represent in comparison to all activity within the same time. For example per hour, my Bots are around 5000 events with Crawlers around 10,000, I'm simply looking for a way to show those numbers next to the total 100,000 of activity for the same hour.

Any thoughts on how to make this happen are appreciated.

Tags (1)
0 Karma
1 Solution

DMohn
Motivator

Try this:

index="Web"
| eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users")
| stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count
| eval bot_percent=round((bot_count/total_count)*100,2)
| eval crawler_percent=round((crawler_count/total_count)*100,2)
| table total_count, bot_count, bot_percent, crawler_count, crawler_percent

View solution in original post

0 Karma

DMohn
Motivator

Try this:

index="Web"
| eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users")
| stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count
| eval bot_percent=round((bot_count/total_count)*100,2)
| eval crawler_percent=round((crawler_count/total_count)*100,2)
| table total_count, bot_count, bot_percent, crawler_count, crawler_percent
0 Karma

jon_marcum
New Member

That's perfect, thanks for the help.

0 Karma

soskaykakehi
Path Finder

Hi @jon_marcum

How about this.

index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic) 
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic) 
| bin _time span=1h
| top WebTraffic by _time
| chart avg(count) as count, avg(percent) as percent over _time by WebTraffic
| addtotals "count: WebTraffic" "count: Bots" "count: Crawlers"
| fields _time "count: WebTraffic" "count: Bots" "count: Crawlers" Total "percent: Bots" "percent: Crawlers"

I hope this would be some of help.

0 Karma
Get Updates on the Splunk Community!

Optimize Cloud Monitoring

  TECH TALKS Optimize Cloud Monitoring Tuesday, August 13, 2024  |  11:00AM–12:00PM PST   Register to ...

What's New in Splunk Cloud Platform 9.2.2403?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.2.2403! Analysts can ...

Stay Connected: Your Guide to July and August Tech Talks, Office Hours, and Webinars!

Dive into our sizzling summer lineup for July and August Community Office Hours and Tech Talks. Scroll down to ...