Splunk Search

How do you tabulate a percentage of field value in a table?

DEAD_BEEF
Builder

My search shows each website category and the number of times each category was visited. What I would like to create is a table that shows the percentage of all events by category rather than the count. I don't know why, but I'm getting no results found with my existing SPL.

sample data

category      count
streaming     50
reference     13
social media  150
gaming        37

desired output

category      percentage
streaming     25.0
reference     6.5
social media  75.0
gaming        18.5

current SPL

index=web
| stats count as grand_total
| stats count by category as cat_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
0 Karma
1 Solution

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

becksyboy
Communicator

Thanks, just what i was looking for.

Tags (1)
0 Karma

DEAD_BEEF
Builder

Exactly what I was looking for. I didn't think of using the value from stats and passing it to eventstats. Thank you!!

Get Updates on the Splunk Community!

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Wednesday, May 29, 2024  |  11AM PST / 2PM ESTRegister now and join us to learn more about how you can ...

Get Your Exclusive Splunk Certified Cybersecurity Defense Engineer Certification at ...

We’re excited to announce a new Splunk certification exam being released at .conf24! If you’re headed to Vegas ...

Share Your Ideas & Meet the Lantern team at .Conf! Plus All of This Month’s New ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...