How do you get the total number of events?

[astatrial]

Hello!

I'm trying to calculate the percentage that a field covers of the total events number, using a search.

This is my search :

[some search]

| fieldsummary 
| rename distinct_count as unique_values 
| eval percentage= (count /** [total]**) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

I'm trying to get the [total] of the events, regardless to the number of results found.

Stats count can't help me because it is not relevant after fieldsummary.

If you know any way to just get the field coverage percentage without calculating it, that is even better.

[chrisyounger · Accepted solution]

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

[astatrial]

Yes, that worked for me, thank you very much!

Just to be clear, the streamstas command count every event that is being over by the search (all the events that answering the first part of the search, before the first pipeline)?

[dkeck]

HI,
if you have an extracted field, your interesting, selected fields and "more fields" should provide you with the percentage of the coverage of each field, did you had a look at this?

Just click on the field, under the name its listed like :

15 Values, 26.215% of events

[astatrial]

Yes, but i'm trying to show this value on a stats table, for all the fields.