How to Count the percentage of stats by two fields (not total)?

[saksona]

[search] |stats count by ClientName Outcome

example:

Client1 Positive count

Client1 Negative count

Client2 Positive count

Client2 Negative count

Client 2 Unknown count

How do I get the percentage for each client outcomes?

Client1 Positive count %

Client1 Negative count  %

Client2 Positive count %

Client2 Negative count %

Client2 Unknown count %

[ITWhisperer · Accepted solution]

[search] |stats count by ClientName Outcome
| eventstats sum(count) as total by ClientName
| eval percent=100*count/total

[saksona]

Don't understand what you mean. It does not do anything.
How do I get the result I am asking for?

[ITWhisperer]

What do you mean "it doesn't do anything"? Please share the search and the results

[saksona]

Oh, I see what I did, but not sure, why that works the way it does.

This is what I did:

[search] |stats count as EventCount by ClientName Outcome
| eventstats sum(EventCount) as total by ClientName
| eval percent=100*count/total

It works when I do what you said exactly!

Thanks!

[ITWhisperer]

Since you renamed the count field, you have to use the new name n the calculation

[search] |stats count as EventCount by ClientName Outcome
| eventstats sum(EventCount) as total by ClientName
| eval percent=100*EventCount/total