I'm fairly new to Splunk, so forgive me if this is an easy question.
I'm trying to sum a field, and then sum as subset (top 10) of the same field so that I can get a percentage of the top 10 users generating web traffic. I can get the individual searches to work no problem, but I can't get them to work together.
Search 1:
index=web category=website123 | stats sum(bytes) as total
Search 2:
index=web category=website123 | stats sum(bytes) as userTotal by userID | sort 10 -userTotal | stats sum(userTotal) as userTotal10
What I want to do is take those two results and do an eval percent=userTotal10/total*100 to give me a percentage. Essentially, I want to be able to show the percentage of traffic generated by the top 10 users. So far, I have not been able to figure out how to do that. Any help would be greatly appreciated.
@nomad I would suggest a slightly different usage of eventstats from @richgalloway which is better from a performance point of view to put later in the pipeline, so it works on fewer events.
index=web category=website123
| stats sum(bytes) as userTotal by userID
| eventstats sum(userTotal) as grandTotal
| sort 10 - userTotal
| stats sum(userTotal) as userTotal10 max(grandTotal) as grandTotal
| eval percent=userTotal10/grandTotal*100
So do that stats by user then eventstats sum those user totals to get the grand total, then do the percent calcs
There are a few ways to do that, but perhaps the easiest is to replace stats with eventstats in Search 1. eventstats calculates statistics without discarding fields the way stats does.
index=web category=website123
| eventstats sum(bytes) as grandTotal
| stats sum(bytes) as userTotal, max(grandTotal) as grandTotal by userID
| sort 10 - userTotal
| stats sum(userTotal) as userTotal10, max(grandTotal) as grandTotal
| eval percent = userTotal*100 / grandTotal
Later calls to stats need to retain the grandTotal field so it can be used in the eval at the end.