Splunk Search

Percent of Total

sondradotcom
Path Finder

I'm trying to figure out how to calculate a percent of total such that:

search string | stats count percent by email

Would spit out:

EMAIL               COUNT PERCENT
email@blah.com          5     10%
otheremail@blah.com    10     20%

Thanks! -S.

Tags (1)

Stephen_Sorkin
Splunk Employee
Splunk Employee

Try the top command:

search string | top email

If you're getting the data from a "stats" or "sistats" in a summary index, it's a bit harder, but certainly possible.

For a summary populated by "stats":

index=summary source=<search_name> | stats sum(count) as count by email | eventstats sum(count) as total | eval percent = round(count/total) . " %" | fields - total

For a summary populated by "sistats":

index=summary source=<search_name> | stats count by email | eventstats sum(count) as total | eval percent = round(count/total) . " %" | fields - total

gkanapathy
Splunk Employee
Splunk Employee

Correct, do not use top in this circumstance. Use stats and eventstats as Stephen as shown above.

0 Karma

sondradotcom
Path Finder

So, I'm searching against a summary index. In an effort to keep the summary index multi-purpose, I created it as a sistats (run hourly), as in:

sourcetype="blah" earliest="-2h@h" latest="-1h@h" | sistats count by email

So if I used "top" for a query on the summary index, and a certain email showed up 100 times each hour, "top" would only count the number of times the email showed up in the summary index (a maximum of one per hour).

So, is it possible to imitate "top" in this circumstance? Am I just making this too hard on myself?

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...