Splunk Search

How to calculate the percentage of total bytes by app?

jwalzerpitt
Influencer

I am having a brain fart on trying to figure out how to find the total bytes per application and the the percent of each app by total bytes.

For example:

appbytes in GBpercentage
SSL300GB23%
DNS100GB13%
etcetcetc

 

Current search is this:

 

index=foo 
| eventstats sum(bytes) as total_bytes 
| stats sum(bytes) as total first(total_bytes) as total_bytes by app 
| eval CompliancePct=round(total/total_bytes,2)

 

Any help would be appreciated

Labels (1)
Tags (3)
0 Karma
1 Solution

johnhuang
Motivator
<base_search>
| stats sum(bytes) AS bytes by app
| eventstats sum(bytes) AS total_bytes
| eval percentage=ROUND((bytes/total_bytes)*100, 2)." %"
| eval app_size_gb=ROUND(bytes/1073741824, 2)
| eval total_size_gb=ROUND(total_bytes/1073741824, 2)
| table app app_size_gb total_size_gb percentage

View solution in original post

johnhuang
Motivator
<base_search>
| stats sum(bytes) AS bytes by app
| eventstats sum(bytes) AS total_bytes
| eval percentage=ROUND((bytes/total_bytes)*100, 2)." %"
| eval app_size_gb=ROUND(bytes/1073741824, 2)
| eval total_size_gb=ROUND(total_bytes/1073741824, 2)
| table app app_size_gb total_size_gb percentage

jwalzerpitt
Influencer

TYVM!

0 Karma
Get Updates on the Splunk Community!

How to Monitor Google Kubernetes Engine (GKE)

We’ve looked at how to integrate Kubernetes environments with Splunk Observability Cloud, but what about ...

Index This | How can you make 45 using only 4?

October 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with this ...

Splunk Education Goes to Washington | Splunk GovSummit 2024

If you’re in the Washington, D.C. area, this is your opportunity to take your career and Splunk skills to the ...