I want to take a list of fields and show the stats displayed on the Selected fields sidebar in a table.
When we do a search, on the left side there is a Selected Fields section. When we click on a field, we see stats on that field, including:
Percent of events overall
Top 10 values and their counts and percents
I would like to put these into a table for each field specified (not just top), and other stats too.
I am also interested in other stats for each field:
Rare 10 values and their counts and percents
Values which deviate from the standard pattern
Type Field Value Count %
All user ALL 99 99%
Top 1 user abc 12 12%
Top 2 ...
Bottom 1 user xyz 13 13%
All dest ALL 98 98%
Maybe it will involve append using top and rare, or perhaps fieldsummary? but is it possible to use eventstats? like:
| table field1 field2 | eventstats count percent by *
fieldsummary has no percent and the values are not well formatted. Plus, there are a lot of extra fields there as well. Perhaps I need to manually format it or are there functions which assist with the formatting and rendering of the data? It also does not seem to show rare values.