Splunk Search

How to display field values as a percentage?

Glasses
Builder

Hi - 

I have been not having much luck creating what I need.

I am looking for the best way to display the percentages of a field's values.

For instance 

 

 

index=foo |stats count by IP

 

 

and the results might be 

IPcountpercentage
10.10.10.112.60
10.10.10.51.05
10.10.10.87.35

 

I am looking for a clean and efficient way to calculate the percentages, in this case, for the occurrence of an IP for a given time in a search.  I will be using it in an ML density function model, so any other suggestion appreciated as well.

Please let me know if you have a suggestion.

Thank you

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might be an easier way to do it but I'd try, for example

<your search>
| stats count by IP
| eventstats sum(count) as total
| eval percentage=count/total
0 Karma
Get Updates on the Splunk Community!

CX Day is Coming!

Customer Experience (CX) Day is on October 7th!! We're so excited to bring back another day full of wonderful ...

Strengthen Your Future: A Look Back at Splunk 10 Innovations and .conf25 Highlights!

The Big One: Splunk 10 is Here!  The moment many of you have been waiting for has arrived! We are thrilled to ...

Now Offering the AI Assistant Usage Dashboard in Cloud Monitoring Console

Today, we’re excited to announce the release of a brand new AI assistant usage dashboard in Cloud Monitoring ...