How do I edit my search using tstats to get top hosts by percentage?

[mcbradford]

I run the following every morning, but I know it could be accomplished more efficiently using tstats, but I cannot get the top host by percentage of all host.

index=* | top  20 host

The following gives me the top host, but I also want to know the percentage of all the hosts.

| tstats count by host | sort -count

[martin_mueller · Accepted solution]

Try this:

| tstats count by host | eventstats sum(count) as total | eval percentage = count/total*100 | fields - total | sort - count | head 20

[martin_mueller]

All you need to do is read the sort docs: | sort 0 - count will work for larger sets.

http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/sort

[w531t4]

I suppose that works, my mistake. Thanks!

[w531t4]

I downvoted this post because doesn't work on large event sets over 10000 rows