How to aggregate a percentage of a total before another search?

[faramarz]

Hey! I am trying to figure out how to aggregate a percentage of the total before another search like this:

eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter by currentPage | eval percent = counter/Total

The percent field is always empty when I try to display it using table, and the variable Total seems to disappear once I get past the stats command. What should I do to preserve that total? Thanks!

Best,
F

[somesoni2 · Accepted solution]

The stats will remove all other fields which are not specified. Try something like this

eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter max(Total) as Total by currentPage | eval percent = counter/Total

Since Total field is generated as same value for all events (eventstats without by clause), you can use any aggregation function of splunk to get it (min, max, values, first, last).

[faramarz]

Amazing. Thanks so much 🙂