I have a search which I am using stats to generate a data grid. Something to the affect of
Choice1 10 Choice2 50 Choice3 100 Choice4 40
I would now like to add a third column that is the percentage of the overall count. So something like
Choice1 10 .05 Choice2 50 .25 Choice3 100 .50 Choice4 40 .20
I suspect I need to use a subsearch for this because each row now depends on the total count but I am not exactly sure how to accomplish this. Any help would be greatly appreciated.
For the earlier question, you could probably do something like this:
... | eventstats count as "totalCount" | eventstats count as "choiceCount" by choice | eval percent=(choiceCount/totalCount)*100 | stats values(choiceCount), values(percent) by choice
Usually, you can avoid eventstats altogether and just use the "top" command (http://docs.splunk.com/Documentation/Splunk/4.2.3/SearchReference/Top ) like so:
... | top choice limit=0
Maybe I am being dense, but the eventstats documentation is baffling and I cannot get it to calculate percentages as asked in the question.
Any chance of a worked example?