Splunk Search

How do you tabulate a percentage of field value in a table?

DEAD_BEEF
Builder

My search shows each website category and the number of times each category was visited. What I would like to create is a table that shows the percentage of all events by category rather than the count. I don't know why, but I'm getting no results found with my existing SPL.

sample data

category      count
streaming     50
reference     13
social media  150
gaming        37

desired output

category      percentage
streaming     25.0
reference     6.5
social media  75.0
gaming        18.5

current SPL

index=web
| stats count as grand_total
| stats count by category as cat_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
0 Karma
1 Solution

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

becksyboy
Contributor

Thanks, just what i was looking for.

Tags (1)
0 Karma

DEAD_BEEF
Builder

Exactly what I was looking for. I didn't think of using the value from stats and passing it to eventstats. Thank you!!

Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  🚀 Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...