Splunk Search

How do you tabulate a percentage of field value in a table?

DEAD_BEEF
Builder

My search shows each website category and the number of times each category was visited. What I would like to create is a table that shows the percentage of all events by category rather than the count. I don't know why, but I'm getting no results found with my existing SPL.

sample data

category      count
streaming     50
reference     13
social media  150
gaming        37

desired output

category      percentage
streaming     25.0
reference     6.5
social media  75.0
gaming        18.5

current SPL

index=web
| stats count as grand_total
| stats count by category as cat_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
0 Karma
1 Solution

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

becksyboy
Communicator

Thanks, just what i was looking for.

Tags (1)
0 Karma

DEAD_BEEF
Builder

Exactly what I was looking for. I didn't think of using the value from stats and passing it to eventstats. Thank you!!

Get Updates on the Splunk Community!

Updated Team Landing Page in Splunk Observability

We’re making some changes to the team landing page in Splunk Observability, based on your feedback. The ...

New! Splunk Observability Search Enhancements for Splunk APM Services/Traces and ...

Regardless of where you are in Splunk Observability, you can search for relevant APM targets including service ...

Webinar Recap | Revolutionizing IT Operations: The Transformative Power of AI and ML ...

The Transformative Power of AI and ML in Enhancing Observability   In the realm of IT operations, the ...