How to limit search results to * % of all results

[kk2204]

I've got a search query which outputs 175 rows. I want it to output only top 5%. The row count will change over time so I cannot set a fixed int value. It needs to be dynamic.

[FelixLeh]

You can either use the top command (https://docs.splunk.com/Documentation/Splunk/latest/SearchReference/Top) 

| top <your_field> limit=<your_choice>

OR
you can use sort and the use head

| sort - count 
| head <number_of_choice>

 If this is inside a dashboard you could create a token based on the amount of search results and input it as the number for head or top command.

[kk2204]

I know that but with your solution I can only use integers such as 5,1,10 etc. I want to limit the results to a certain percentage of all possible results.

[PickleRick · Accepted solution]

<yoursearch>
| evenstats count as total
| streamstats count as current
| where current<=0.15*total

[FelixLeh]

Great Solution!
But there was a typo and it disregarded the amount of count.
Added a sort to your solution.

<your_search>
| stats count by user
| sort - count
| eventstats count as total
| streamstats count as current
| where current<=0.15*total

[PickleRick]

What is your way of sorting, groupping, ordering and so on is up to you. 🙂

"My" part only did the limiting.

[kk2204]

Thanks both of you guys!