Splunk Search

How do I show top 5% of users after stats sum?

MayraEllen
New Member

Desired Outcome:
Shows only the top 5% of people who have spent more than 10000
Table Output - Just the User ID and the amount

Current Outcome:
Shows everyone who has spent more than 10k

Information:
This is my latest try, but it is ignoring my perc5 part (I tried 95 as well, same result)

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | stats perc5(Spent) by user_account_id

I've been scouring the Internet and trying five million things and can't get this to work as it just keeps showing everyone.

0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter

View solution in original post

0 Karma

somesoni2
SplunkTrust
SplunkTrust

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter
0 Karma

MayraEllen
New Member

That totally did it, now just to hide the "filter" column, but that's not that big a deal and the underlying issue is now resolved.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...