Hi all,
Another question...
I have two extracted fields: "MB" and "site".
I wish to do the following, over a period in time, calculate the total MB in my data.
base search | stats sum(MB) as MBdata by site
Results in a table: MBdata and site, thus the MB of data used per website, fairly simple...
Now, I want to bring in a percentage... (the hard part)
What I want to achieve is this, a table, listing sites and the percentage of "total data" each have used.
Any help?
Thanks,
Aaron.
You need to use eventstats and eval. Assuming you want it to 2dp try
base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total
Bob
You need to use eventstats and eval. Assuming you want it to 2dp try
base search | stats sum(MB) as MBdata by site | eventstats sum(MBdata) as total | eval percent=round(MBdata/total*100,2) | fields - total
Bob
Doesn't matter yours worked first try... Thanks for the help, very much appreciate it.
Damn 20 sec too late