Splunk Search

How to aggregate a percentage of a total before another search?

faramarz
Path Finder

Hey! I am trying to figure out how to aggregate a percentage of the total before another search like this:

eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter by currentPage | eval percent = counter/Total

The percent field is always empty when I try to display it using table, and the variable Total seems to disappear once I get past the stats command. What should I do to preserve that total? Thanks!

Best,
F

0 Karma
1 Solution

somesoni2
Revered Legend

The stats will remove all other fields which are not specified. Try something like this

eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter max(Total) as Total by currentPage | eval percent = counter/Total

Since Total field is generated as same value for all events (eventstats without by clause), you can use any aggregation function of splunk to get it (min, max, values, first, last).

View solution in original post

somesoni2
Revered Legend

The stats will remove all other fields which are not specified. Try something like this

eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter max(Total) as Total by currentPage | eval percent = counter/Total

Since Total field is generated as same value for all events (eventstats without by clause), you can use any aggregation function of splunk to get it (min, max, values, first, last).

faramarz
Path Finder

Amazing. Thanks so much :slightly_smiling_face:

0 Karma
Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...