How to edit my search to find the percentage of total bytes used for each URI path in the top 10?

[dovelsh12223621]

Hi everyone,

I need your help. My current search is like this:

index="ihs_test"  uri_path="*.jhtml" OR uri_path="*.html"  | transaction clientip  | search bytes!="-" | stats sum(bytes) as total_usebytes |appendcols [search index="ihs_test"  uri_path="*.jhtml" OR uri_path="*.html"  | transaction clientip   | search bytes!="-" | stats sum(bytes) as total_usebytes_by_uri_path  by uri_path] | eval percentage=total_usebytes_by_uri_path/total_usebytes

I need to know the percentage of total bytes used for every page in the top 10. How do I do this?

[ppablo]

Hi @dovelsh12223621

Just following up with this post, but did @lguinn's search below answer your question? If yes, don't forget to resolve the post by clicking "Accept" directly below her answer and upvote it by clicking the up arrow to the left of the answer.

[lguinn2 · Accepted solution]

Try this

index="ihs_test"  uri_path="*.jhtml" OR uri_path="*.html"  
| transaction clientip  
| search bytes!="-" 
| stats sum(bytes) as as total_usebytes_by_uri_path  by uri_path
| eventstats sum(total_usebytes_by_uri_path) as total_usebytes
| eval percentage=total_usebytes_by_uri_path/total_usebytes
| sort 10 -percentage 

Without the subsearch, this should run dramatically faster. Why do you need the transaction command at all?