Splunk Search

How do you get the total number of events?

astatrial
Contributor

Hello!

I'm trying to calculate the percentage that a field covers of the total events number, using a search.

This is my search :

[some search]

| fieldsummary 
| rename distinct_count as unique_values 
| eval percentage= (count /** [total]**) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

I'm trying to get the [total] of the events, regardless to the number of results found.

alt text

Stats count can't help me because it is not relevant after fieldsummary.

If you know any way to just get the field coverage percentage without calculating it, that is even better.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

0 Karma

astatrial
Contributor

Yes, that worked for me, thank you very much!

Just to be clear, the streamstas command count every event that is being over by the search (all the events that answering the first part of the search, before the first pipeline)?

0 Karma

dkeck
Influencer

HI,
if you have an extracted field, your interesting, selected fields and "more fields" should provide you with the percentage of the coverage of each field, did you had a look at this?

Just click on the field, under the name its listed like :

15 Values, 26.215% of events

0 Karma

astatrial
Contributor

Yes, but i'm trying to show this value on a stats table, for all the fields.

0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Unified Identity - Now Available for Existing Splunk ...

Raise your hand if you’ve already forgotten your username or password when logging into an account. (We can’t ...

Index This | How many sides does a circle have?

February 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

Registration for Splunk University is Now Open!

Are you ready for an adventure in learning?   Brace yourselves because Splunk University is back, and it's ...