Splunk Search

How to display field values as a percentage?

Glasses
Builder

Hi - 

I have been not having much luck creating what I need.

I am looking for the best way to display the percentages of a field's values.

For instance 

 

 

index=foo |stats count by IP

 

 

and the results might be 

IPcountpercentage
10.10.10.112.60
10.10.10.51.05
10.10.10.87.35

 

I am looking for a clean and efficient way to calculate the percentages, in this case, for the occurrence of an IP for a given time in a search.  I will be using it in an ML density function model, so any other suggestion appreciated as well.

Please let me know if you have a suggestion.

Thank you

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might be an easier way to do it but I'd try, for example

<your search>
| stats count by IP
| eventstats sum(count) as total
| eval percentage=count/total
0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...