Splunk Search

How to add percentage on statistic field?

appleman
Contributor

Hello,

My search: index=test sourcetype=traffic | stats sum(A) as A sum(B) as B sum(C) as C sum(D) as D | transpose

A,B,C,D are number, but when I use top command to show percentage, it calculates the number as name, so the result turns out to be 1, which means 25% each.
How do I add percentage of each column on statistic fields?


以下のサーチから出るそれぞれのfield(A,B,C,D)のパーセンテージを表すにはどうしたらよいでしょうか。

サーチ文: index=test sourcetype=traffic | stats sum(A) as A sum(B) as B sum(C) as C sum(D) as D | transpose

※A,B,C,Dはネットワークトラフィックを表す数字です。

単純にtopコマンドを利用するだけでは、それぞれのフィールドの数字を数字として読み取らず、カウントが1となってしまって、それぞれ25%と表示されてしまいます。。。。

0 Karma
1 Solution

melonman
Motivator

おそらく、、、こんな感じではないでしょうか。

... | stats sum(A) as A ... | transpose 
| rename column as name, "row 1" as count 
| eventstats sum(count) as total 
| eval percent=100*(count/total) 
| fields - total

View solution in original post

melonman
Motivator

おそらく、、、こんな感じではないでしょうか。

... | stats sum(A) as A ... | transpose 
| rename column as name, "row 1" as count 
| eventstats sum(count) as total 
| eval percent=100*(count/total) 
| fields - total

appleman
Contributor

ありがとうございます!

0 Karma
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...