Splunk Search

How to display field values as a percentage?

Glasses
Builder

Hi - 

I have been not having much luck creating what I need.

I am looking for the best way to display the percentages of a field's values.

For instance 

 

 

index=foo |stats count by IP

 

 

and the results might be 

IPcountpercentage
10.10.10.112.60
10.10.10.51.05
10.10.10.87.35

 

I am looking for a clean and efficient way to calculate the percentages, in this case, for the occurrence of an IP for a given time in a search.  I will be using it in an ML density function model, so any other suggestion appreciated as well.

Please let me know if you have a suggestion.

Thank you

Labels (2)
0 Karma

PickleRick
SplunkTrust
SplunkTrust

Might be an easier way to do it but I'd try, for example

<your search>
| stats count by IP
| eventstats sum(count) as total
| eval percentage=count/total
0 Karma
Get Updates on the Splunk Community!

Index This | Why did the turkey cross the road?

November 2025 Edition  Hayyy Splunk Education Enthusiasts and the Eternally Curious!   We’re back with this ...

Enter the Agentic Era with Splunk AI Assistant for SPL 1.4

  &#x1f680; Your data just got a serious AI upgrade — are you ready? Say hello to the Agentic Era with the ...

Feel the Splunk Love: Real Stories from Real Customers

Hello Splunk Community,    What’s the best part of hearing how our customers use Splunk? Easy: the positive ...