Splunk Search

How do you get the total number of events?

astatrial
Contributor

Hello!

I'm trying to calculate the percentage that a field covers of the total events number, using a search.

This is my search :

[some search]

| fieldsummary 
| rename distinct_count as unique_values 
| eval percentage= (count /** [total]**) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

I'm trying to get the [total] of the events, regardless to the number of results found.

alt text

Stats count can't help me because it is not relevant after fieldsummary.

If you know any way to just get the field coverage percentage without calculating it, that is even better.

0 Karma
1 Solution

chrisyounger
SplunkTrust
SplunkTrust

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

View solution in original post

0 Karma

chrisyounger
SplunkTrust
SplunkTrust

HI @astatrial

Give this a try:

<your search> 
| streamstats count as UNIQUE_ID 
| fieldsummary 
| eventstats max(count) as TOTAL_RECORDS
| rename distinct_count as unique_values 
| eval percentage= (count /  TOTAL_RECORDS) * 100 
| table field count unique_values percentage 
| fieldformat percentage = printf("%.2f",percentage)."%"

There is probably a better way, but this should do what you need. Also be aware that the unique_values field has a max of 500 per field.

Good luck!

0 Karma

astatrial
Contributor

Yes, that worked for me, thank you very much!

Just to be clear, the streamstas command count every event that is being over by the search (all the events that answering the first part of the search, before the first pipeline)?

0 Karma

dkeck
Influencer

HI,
if you have an extracted field, your interesting, selected fields and "more fields" should provide you with the percentage of the coverage of each field, did you had a look at this?

Just click on the field, under the name its listed like :

15 Values, 26.215% of events

0 Karma

astatrial
Contributor

Yes, but i'm trying to show this value on a stats table, for all the fields.

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...