Splunk Search

How do you get the total number of events?

Communicator

Hello!

I'm trying to calculate the percentage that a field covers of the total events number, using a search.

This is my search :

[some search]

| fieldsummary 
| rename distinct_count as unique_values 
| eval percentage= (count /** [total]**) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

I'm trying to get the [total] of the events, regardless to the number of results found.

alt text

Stats count can't help me because it is not relevant after fieldsummary.

If you know any way to just get the field coverage percentage without calculating it, that is even better.

0 Karma
1 Solution

SplunkTrust
SplunkTrust

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

View solution in original post

0 Karma

SplunkTrust
SplunkTrust

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

View solution in original post

0 Karma

Communicator

Yes, that worked for me, thank you very much!

Just to be clear, the streamstas command count every event that is being over by the search (all the events that answering the first part of the search, before the first pipeline)?

0 Karma

Influencer

HI,
if you have an extracted field, your interesting, selected fields and "more fields" should provide you with the percentage of the coverage of each field, did you had a look at this?

Just click on the field, under the name its listed like :

15 Values, 26.215% of events

0 Karma

Communicator

Yes, but i'm trying to show this value on a stats table, for all the fields.

0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!