Eval results compared to Total counts

[jon_marcum]

I would like to display all Bot and Crawler activity compared to the total amount of events.

index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic)
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic)
| top WebTraffic

This provides a clear display of my Bots and Crawlers count but I would like to show what percentage the counts represent in comparison to all activity within the same time. For example per hour, my Bots are around 5000 events with Crawlers around 10,000, I'm simply looking for a way to show those numbers next to the total 100,000 of activity for the same hour.

Any thoughts on how to make this happen are appreciated.

[DMohn · Accepted solution]

Try this:

index="Web"
| eval WebTraffic = case(match(http_user_agent, "(?i)bot"), "Bots",match(http_user_agent, "(?i)crawl"), "Crawlers",1=1,"Users")
| stats count as total_count, count(eval(WebTraffic="Bots")) as bot_count, count(eval(WebTraffic="Crawlers")) as crawler_count
| eval bot_percent=round((bot_count/total_count)*100,2)
| eval crawler_percent=round((crawler_count/total_count)*100,2)
| table total_count, bot_count, bot_percent, crawler_count, crawler_percent

[jon_marcum]

That's perfect, thanks for the help.

[soskaykakehi]

Hi @jon_marcum

How about this.

index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic) 
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic) 
| bin _time span=1h
| top WebTraffic by _time
| chart avg(count) as count, avg(percent) as percent over _time by WebTraffic
| addtotals "count: WebTraffic" "count: Bots" "count: Crawlers"
| fields _time "count: WebTraffic" "count: Bots" "count: Crawlers" Total "percent: Bots" "percent: Crawlers"

I hope this would be some of help.