Splunk Search

Percentage of overall volume with timechart command

tmurray3
Path Finder

I am trying to create a report to display the top 5 clients by total volume and their percentage of total volume from a summary index.

Currently, I am reporting top 5 clients by total volume. Here is my query:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart limit=5 span=1h sum(count)  by clientkey

    _time   c1  client2     OTHER   client3 client4 client5
1   12/15/14 12:00:00.000 AM    587556  184696  989182  1204554 1616047 1100108
2   12/16/14 12:00:00.000 AM    11343   28820   366656  74062   573534  100928

Since the index summary was not created with the sitop command, is there another way to calculate the top 5 clients which displays volume by clientkey and total percentage of overall volume by clientkey?

Thanks in advance for your help!!!

Tags (2)
0 Karma
1 Solution

tmurray3
Path Finder

Here is the query I used to solve the problem:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart span=1d sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval keypercent=round(count*100/Total,2)| table _time,clientkey keypercent | xyseries _time clientkey keypercent 

View solution in original post

0 Karma

tmurray3
Path Finder

Here is the query I used to solve the problem:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart span=1d sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval keypercent=round(count*100/Total,2)| table _time,clientkey keypercent | xyseries _time clientkey keypercent 
0 Karma
Get Updates on the Splunk Community!

Splunk Lantern | Getting Started with Edge Processor, Machine Learning Toolkit ...

Splunk Lantern is Splunk’s customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In the last month, the Splunk Threat Research Team (STRT) has had 2 releases of new security content via the ...

Announcing the 1st Round Champion’s Tribute Winners of the Great Resilience Quest

We are happy to announce the 20 lucky questers who are selected to be the first round of Champion's Tribute ...