Splunk Search

How do I show top 5% of users after stats sum?

MayraEllen
New Member

Desired Outcome:
Shows only the top 5% of people who have spent more than 10000
Table Output - Just the User ID and the amount

Current Outcome:
Shows everyone who has spent more than 10k

Information:
This is my latest try, but it is ignoring my perc5 part (I tried 95 as well, same result)

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | stats perc5(Spent) by user_account_id

I've been scouring the Internet and trying five million things and can't get this to work as it just keeps showing everyone.

0 Karma
1 Solution

somesoni2
Revered Legend

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter

View solution in original post

0 Karma

somesoni2
Revered Legend

Give this a try

 |stats sum(actual_cost) as Spent by user_account_id | where Spent > 10000 | eventstats perc5(Spent) as filter | where Spend>=filter
0 Karma

MayraEllen
New Member

That totally did it, now just to hide the "filter" column, but that's not that big a deal and the underlying issue is now resolved.

Thank you!

0 Karma
Get Updates on the Splunk Community!

Announcing General Availability of Splunk Incident Intelligence!

Digital transformation is real! Across industries, companies big and small are going through rapid digital ...

Splunk Training for All: Meet Aspiring Cybersecurity Analyst, Marc Alicea

Splunk Education believes in the value of training and certification in today’s rapidly-changing data-driven ...

The Splunk Success Framework: Your Guide to Successful Splunk Implementations

Splunk Lantern is a customer success center that provides advice from Splunk experts on valuable data ...