I'm trying to figure out how to calculate a percent of total such that:
search string | stats count percent by email
Would spit out:
EMAIL COUNT PERCENT firstname.lastname@example.org 5 10% email@example.com 10 20%
search string | top email
If you're getting the data from a "stats" or "sistats" in a summary index, it's a bit harder, but certainly possible.
For a summary populated by "stats":
index=summary source=<search_name> | stats sum(count) as count by email | eventstats sum(count) as total | eval percent = round(count/total) . " %" | fields - total
For a summary populated by "sistats":
index=summary source=<search_name> | stats count by email | eventstats sum(count) as total | eval percent = round(count/total) . " %" | fields - total
So, I'm searching against a summary index. In an effort to keep the summary index multi-purpose, I created it as a sistats (run hourly), as in:
sourcetype="blah" earliest="-2h@h" latest="-1h@h" | sistats count by email
So if I used "top" for a query on the summary index, and a certain email showed up 100 times each hour, "top" would only count the number of times the email showed up in the summary index (a maximum of one per hour).
So, is it possible to imitate "top" in this circumstance? Am I just making this too hard on myself?