How to edit my stats search to find the percentage of a range?

[dcascione]

I'm trying to build a simple SPL query to display the max, min, range (difference), and percent of the difference to the max value.

index=myindex source="mysource"| stats max(count), min(count), range(count)|rename max(count) to "Max", min(count) to "Min", range(count) to "Difference"

Tried using the perc(y) stats function with no luck... Also tried some basic math which blows up every time..

range(count) \ max(count)*100 

Thanks for your help in advance.

[javiergn · Accepted solution]

Hi, is count an existing field in your data?
If so try the following:

index=myindex source="mysource"
| stats max(count) as Max, min(count) as Min, range(count) as Difference
| eval Difference_Percent = Difference / Max * 100

If not, you need to calculate the value of count first (probably using stats count)

[dcascione]

Yes -"count" is an existing field . This worked - Thanks for the answer!