Splunk Search

How to display field values as a percentage?

Glasses
Builder

Hi - 

I have been not having much luck creating what I need.

I am looking for the best way to display the percentages of a field's values.

For instance 

 

 

index=foo |stats count by IP

 

 

and the results might be 

IPcountpercentage
10.10.10.112.60
10.10.10.51.05
10.10.10.87.35

 

I am looking for a clean and efficient way to calculate the percentages, in this case, for the occurrence of an IP for a given time in a search.  I will be using it in an ML density function model, so any other suggestion appreciated as well.

Please let me know if you have a suggestion.

Thank you

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might be an easier way to do it but I'd try, for example

<your search>
| stats count by IP
| eventstats sum(count) as total
| eval percentage=count/total
0 Karma
Get Updates on the Splunk Community!

.conf25 technical session recap of Observability for Gen AI: Monitoring LLM ...

If you’re unfamiliar, .conf is Splunk’s premier event where the Splunk community, customers, partners, and ...

A Season of Skills: New Splunk Courses to Light Up Your Learning Journey

There’s something special about this time of year—maybe it’s the glow of the holidays, maybe it’s the ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to ...

Announcing the Migration of the Splunk Add-on for Microsoft Azure Inputs to Officially Supported Splunk ...