Splunk Search

Help with summing Values and Eval

nomad
Engager

I'm fairly new to Splunk, so forgive me if this is an easy question.

I'm trying to sum a field, and then sum as subset (top 10) of the same field so that I can get a percentage of the top 10 users generating web traffic. I can get the individual searches to work no problem, but I can't get them to work together.

Search 1:

index=web category=website123 | stats sum(bytes) as total

Search 2:

index=web category=website123 | stats sum(bytes) as userTotal by userID | sort 10 -userTotal | stats sum(userTotal) as userTotal10

What I want to do is take those two results and do an eval percent=userTotal10/total*100 to give me a percentage. Essentially, I want to be able to show the percentage of traffic generated by the top 10 users. So far, I have not been able to figure out how to do that. Any help would be greatly appreciated.

Labels (2)
0 Karma

bowesmana
SplunkTrust
SplunkTrust

@nomad  I would suggest a slightly different usage of eventstats from @richgalloway which is better from a performance point of view to put later in the pipeline, so it works on fewer events.

index=web category=website123 
| stats sum(bytes) as userTotal by userID
| eventstats sum(userTotal) as grandTotal
| sort 10 - userTotal 
| stats sum(userTotal) as userTotal10 max(grandTotal) as grandTotal
| eval percent=userTotal10/grandTotal*100

So do that stats by user then eventstats sum those user totals to get the grand total, then do the  percent calcs

 

0 Karma

richgalloway
SplunkTrust
SplunkTrust

There are a few ways to do that, but perhaps the easiest is to replace stats with eventstats in Search 1.  eventstats calculates statistics without discarding fields the way stats does.

index=web category=website123 
| eventstats sum(bytes) as grandTotal
| stats sum(bytes) as userTotal, max(grandTotal) as grandTotal by userID 
| sort 10 - userTotal 
| stats sum(userTotal) as userTotal10, max(grandTotal) as grandTotal
| eval percent = userTotal*100 / grandTotal

Later calls to stats need to retain the grandTotal field so it can be used in the eval at the end.

 

---
If this reply helps you, Karma would be appreciated.
0 Karma
Get Updates on the Splunk Community!

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Announcing the General Availability of Splunk Enterprise Security 8.1!

We are pleased to announce the general availability of Splunk Enterprise Security 8.1. Splunk becomes the only ...

Developer Spotlight with William Searle

The Splunk Guy: A Developer’s Path from Web to Cloud William is a Splunk Professional Services Consultant with ...