Splunk Search

How do I show top 5% of users after stats sum?

MayraEllen
New Member

Desired Outcome:
Shows only the top 5% of people who have spent more than 10000
Table Output - Just the User ID and the amount

Current Outcome:
Shows everyone who has spent more than 10k

Information:
This is my latest try, but it is ignoring my perc5 part (I tried 95 as well, same result)

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | stats perc5(Spent) by user_account_id

I've been scouring the Internet and trying five million things and can't get this to work as it just keeps showing everyone.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter
0 Karma

MayraEllen
New Member

That totally did it, now just to hide the "filter" column, but that's not that big a deal and the underlying issue is now resolved.

Thank you!

0 Karma
Get Updates on the Splunk Community!

What the End of Support for Splunk Add-on Builder Means for You

Hello Splunk Community! We want to share an important update regarding the future of the Splunk Add-on Builder ...

Solve, Learn, Repeat: New Puzzle Channel Now Live

Welcome to the Splunk Puzzle PlaygroundIf you are anything like me, you love to solve problems, and what ...

Building Reliable Asset and Identity Frameworks in Splunk ES

 Accurate asset and identity resolution is the backbone of security operations. Without it, alerts are ...