Splunk Search

How to calculate the percentage of total bytes by app?

jwalzerpitt
Influencer

I am having a brain fart on trying to figure out how to find the total bytes per application and the the percent of each app by total bytes.

For example:

appbytes in GBpercentage
SSL300GB23%
DNS100GB13%
etcetcetc

 

Current search is this:

 

index=foo 
| eventstats sum(bytes) as total_bytes 
| stats sum(bytes) as total first(total_bytes) as total_bytes by app 
| eval CompliancePct=round(total/total_bytes,2)

 

Any help would be appreciated

Labels (1)
Tags (3)
0 Karma
1 Solution

johnhuang
Motivator
<base_search>
| stats sum(bytes) AS bytes by app
| eventstats sum(bytes) AS total_bytes
| eval percentage=ROUND((bytes/total_bytes)*100, 2)." %"
| eval app_size_gb=ROUND(bytes/1073741824, 2)
| eval total_size_gb=ROUND(total_bytes/1073741824, 2)
| table app app_size_gb total_size_gb percentage

View solution in original post

johnhuang
Motivator
<base_search>
| stats sum(bytes) AS bytes by app
| eventstats sum(bytes) AS total_bytes
| eval percentage=ROUND((bytes/total_bytes)*100, 2)." %"
| eval app_size_gb=ROUND(bytes/1073741824, 2)
| eval total_size_gb=ROUND(total_bytes/1073741824, 2)
| table app app_size_gb total_size_gb percentage

jwalzerpitt
Influencer

TYVM!

0 Karma
Get Updates on the Splunk Community!

Streamline Data Ingestion With Deployment Server Essentials

REGISTER NOW!Every day the list of sources Admins are responsible for gets bigger and bigger, often making the ...

Remediate Threats Faster and Simplify Investigations With Splunk Enterprise Security ...

REGISTER NOW!Join us for a Tech Talk around our latest release of Splunk Enterprise Security 7.2! We’ll walk ...

Introduction to Splunk AI

WATCH NOWHow are you using AI in Splunk? Whether you see AI as a threat or opportunity, AI is here to stay. ...