Splunk Search

How to display field values as a percentage?

Glasses
Builder

Hi - 

I have been not having much luck creating what I need.

I am looking for the best way to display the percentages of a field's values.

For instance 

 

 

index=foo |stats count by IP

 

 

and the results might be 

IPcountpercentage
10.10.10.112.60
10.10.10.51.05
10.10.10.87.35

 

I am looking for a clean and efficient way to calculate the percentages, in this case, for the occurrence of an IP for a given time in a search.  I will be using it in an ML density function model, so any other suggestion appreciated as well.

Please let me know if you have a suggestion.

Thank you

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might be an easier way to do it but I'd try, for example

<your search>
| stats count by IP
| eventstats sum(count) as total
| eval percentage=count/total
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

.conf25 Global Broadcast: Don’t Miss a Moment

Hello Splunkers, .conf25 is only a click away.  Not able to make it to .conf25 in person? No worries, you can ...

Observe and Secure All Apps with Splunk

 Join Us for Our Next Tech Talk: Observe and Secure All Apps with SplunkAs organizations continue to innovate ...

What's New in Splunk Observability - August 2025

What's New We are excited to announce the latest enhancements to Splunk Observability Cloud as well as what is ...