How do you find the percent of each srcip within a stats command?

[bobbychanthongp]

base search | stats values(srcip) as Source count by catdesc

Above is my search. The results now yield each category description (catdesc) and lists each srcip for the catdesc. How do I break down each srcip by percent of the toal number of events? I need my table to be:

catdesc Source Percent Count
Pornography x.x.x.x 25% 200
y.y.y.y 50%

z.z.z.z 25%

Gaming a.a.a.a 50% 100
b.b.b.b 50%

Thanks.

[gcusello]

Hi
see this example

index=wineventlog | head 100
| stats count BY Dominio_account EventCode
| eventstats sum(count) AS total BY Dominio_account
| eval perc=round(count/total*100,2)."%"

In your search

base search 
| stats count AS Count by catdesc srcip
| eventstats sum(count) AS total BY catdesc 
| eval Percent=round(Count/total*100,2)."%"
| rename srcip AS Source
| table catdesc Source Percent Count

Bye.
Giuseppe

[bobbychanthongp]

Thank you. It is exactly what I needed. However the eventstats sum(count) should be eventstats sum(Count).

[gcusello]

yes sorry!
If this answer satisfies your need, please accept it.
Bye.
Giuseppe