Percentages display

[shreyad]

If I want to display percentages as well as a count for a table and I want the percentages out of the total count of the table, how do I display that?

|multisearch [search index = blah sourcetype="blah" host=blah | tstats count WHERE index = blah sourcetype="blah" host=blah earliest=@mon
| eval earliest=if(cou... OR ("NAME"="blah") | eval Coast ="EastCoast"]

[search index = blah sourcetype="blah " host=blah
| tstats count WHERE index = blah sourcetype="blah " host=blah earliest=@mon
| eval earliest=if(cou...
OR ("NAME"="blah *") | eval Coast ="WestCoast"]| dedup HOST.IP |stats count(blah) as NumberOfIPs by Coast

[somesoni2]

Try like this

|multisearch [search index = blah sourcetype="blah" host=blah [| tstats count WHERE index = blah sourcetype="blah" host=blah  earliest=@mon 
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ] 
 ("NAME"="blah_*") OR ("NAME"="blah") | eval Coast ="EastCoast"] 
[search index = blah sourcetype="blah " host=blah
[| tstats count WHERE index = blah sourcetype="blah " host=blah earliest=@mon 
| eval earliest=if(count=0,"-1mon@mon","@mon") 
| table earliest ] 
("NAME"="blah _*") OR ("NAME"="blah *") | eval Coast ="WestCoast"]| dedup HOST.IP |stats count(blah) as NumberOfIPs by Coast
| eventstats sum(NumberOfIPs) as Total
| eval Percentage=round(NumberOfIPs*100/Total,2) 
| fields - Total

[shreyad]

Thank you!

[CarsonZa]

you could use |top otherwise you'll have to do some math.

|stats count(_raw) as total
|stats count(x) by x as foo
|eval perc = ((foo / total)*100) + "%"

http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Top