How to show the percentage of unique values

[ewanbrown]

Hi,

I have a simple search that uses top to get the top 10 countries:

   search ........ | top Country

It will give the top 10 Countries and percentage.

How can I get the same, but look at the top 10 Countries by unique users?

This :

 search ..... | stats dc(ID) as users by  Country | sort users desc limit=10

Will give me the top 10, but not show the % for each.

Is there a way to do this?

Thanks

[cmerriman · Accepted solution]

try this:

 search ..... | eventstats dc(ID) as totalUsers|stats max(totalUsers) as totalUsers dc(ID) as users by  Country | sort users desc limit=10|eval percentage=users/totalUsers*100|fields - totalUsers

[ewanbrown]

Perfect!

Thanks, I knew it was something to do with eventstats, but couldn't get it to work!