Splunk Search

Percentage of overall volume with timechart command

tmurray3
Path Finder

I am trying to create a report to display the top 5 clients by total volume and their percentage of total volume from a summary index.

Currently, I am reporting top 5 clients by total volume. Here is my query:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart limit=5 span=1h sum(count)  by clientkey

    _time   c1  client2     OTHER   client3 client4 client5
1   12/15/14 12:00:00.000 AM    587556  184696  989182  1204554 1616047 1100108
2   12/16/14 12:00:00.000 AM    11343   28820   366656  74062   573534  100928

Since the index summary was not created with the sitop command, is there another way to calculate the top 5 clients which displays volume by clientkey and total percentage of overall volume by clientkey?

Thanks in advance for your help!!!

Tags (2)
0 Karma
1 Solution

tmurray3
Path Finder

Here is the query I used to solve the problem:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart span=1d sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval keypercent=round(count*100/Total,2)| table _time,clientkey keypercent | xyseries _time clientkey keypercent 

View solution in original post

0 Karma

tmurray3
Path Finder

Here is the query I used to solve the problem:

index=client_volume_hourly_summary report="keyvolumebyhour" | timechart span=1d sum(count) by clientkey limit=5| untable _time clientkey count|eventstats sum(count) as Total by _time|eval keypercent=round(count*100/Total,2)| table _time,clientkey keypercent | xyseries _time clientkey keypercent 
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...