Splunk Search

How do I show top 5% of users after stats sum?

New Member

Desired Outcome:
Shows only the top 5% of people who have spent more than 10000
Table Output - Just the User ID and the amount

Current Outcome:
Shows everyone who has spent more than 10k

Information:
This is my latest try, but it is ignoring my perc5 part (I tried 95 as well, same result)

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | stats perc5(Spent) by user_account_id

I've been scouring the Internet and trying five million things and can't get this to work as it just keeps showing everyone.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter

View solution in original post

0 Karma

New Member

That totally did it, now just to hide the "filter" column, but that's not that big a deal and the underlying issue is now resolved.

Thank you!

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!