Help with summing Values and Eval

[nomad]

I'm fairly new to Splunk, so forgive me if this is an easy question.

I'm trying to sum a field, and then sum as subset (top 10) of the same field so that I can get a percentage of the top 10 users generating web traffic. I can get the individual searches to work no problem, but I can't get them to work together.

Search 1:

index=web category=website123 | stats sum(bytes) as total

Search 2:

index=web category=website123 | stats sum(bytes) as userTotal by userID | sort 10 -userTotal | stats sum(userTotal) as userTotal10

What I want to do is take those two results and do an eval percent=userTotal10/total*100 to give me a percentage. Essentially, I want to be able to show the percentage of traffic generated by the top 10 users. So far, I have not been able to figure out how to do that. Any help would be greatly appreciated.

[bowesmana]

@nomad  I would suggest a slightly different usage of eventstats from @richgalloway which is better from a performance point of view to put later in the pipeline, so it works on fewer events.

index=web category=website123 
| stats sum(bytes) as userTotal by userID
| eventstats sum(userTotal) as grandTotal
| sort 10 - userTotal 
| stats sum(userTotal) as userTotal10 max(grandTotal) as grandTotal
| eval percent=userTotal10/grandTotal*100

So do that stats by user then eventstats sum those user totals to get the grand total, then do the  percent calcs

[richgalloway]

There are a few ways to do that, but perhaps the easiest is to replace stats with eventstats in Search 1.  eventstats calculates statistics without discarding fields the way stats does.

index=web category=website123 
| eventstats sum(bytes) as grandTotal
| stats sum(bytes) as userTotal, max(grandTotal) as grandTotal by userID 
| sort 10 - userTotal 
| stats sum(userTotal) as userTotal10, max(grandTotal) as grandTotal
| eval percent = userTotal*100 / grandTotal

Later calls to stats need to retain the grandTotal field so it can be used in the eval at the end.