Splunk Search

How do I show top 5% of users after stats sum?

MayraEllen
New Member

Desired Outcome:
Shows only the top 5% of people who have spent more than 10000
Table Output - Just the User ID and the amount

Current Outcome:
Shows everyone who has spent more than 10k

Information:
This is my latest try, but it is ignoring my perc5 part (I tried 95 as well, same result)

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | stats perc5(Spent) by user_account_id

I've been scouring the Internet and trying five million things and can't get this to work as it just keeps showing everyone.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter
0 Karma

MayraEllen
New Member

That totally did it, now just to hide the "filter" column, but that's not that big a deal and the underlying issue is now resolved.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Splunk Observability for AI

Don’t miss out on an exciting Tech Talk on Splunk Observability for AI!Discover how Splunk’s agentic AI ...

Splunk Enterprise Security 8.x: The Essential Upgrade for Threat Detection, ...

Watch On Demand the Tech Talk on November 6 at 11AM PT, and empower your SOC to reach new heights! Duration: ...

Splunk Observability as Code: From Zero to Dashboard

For the details on what Self-Service Observability and Observability as Code is, we have some awesome content ...