Splunk Search

Subtotal percentage with stats

dauren_akilbeko
Communicator

I'm working with Windows events, and want to make following report/search:

process1                                                                                                            Total XX XX%
                                                        command_line1 XX%
                                                        command_line2 XX%

process4                                                                                                            Total XX XX%
                                                        command_line1 XX%
                                                        command_line2 XX%

 

What I come up with:

 

 

`index_windows` EventCode=4688 
| fields Process_Command_Line, New_Process_Name 
| stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerProcess by New_Process_Name
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2)
| sort - totalCount

 

 

 

The only thing is that I can't figure out how to merge fields by New_Process_Name

dauren_akilbeko_0-1623837792088.png

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
`index_windows` EventCode=4688 
| fields Process_Command_Line, New_Process_Name 
| stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerProcess by New_Process_Name
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2)
| stats list(Process_Command_Line) as Process_Command_line list(percentageTotal) as percentageTotal values(percentagePerProcess) as percentagePerProcess by New_Process_Name
| sort - totalCount

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
`index_windows` EventCode=4688 
| fields Process_Command_Line, New_Process_Name 
| stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerProcess by New_Process_Name
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2)
| stats list(Process_Command_Line) as Process_Command_line list(percentageTotal) as percentageTotal values(percentagePerProcess) as percentagePerProcess by New_Process_Name
| sort - totalCount

dauren_akilbeko
Communicator

Thank you, so simple! 🙄 Changed list to values though, as it hit the limit.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The reason for list rather than values is to keep the count and process in line because values sorts them. If you can't use list, you should consider creating a concatenated field before using values.

Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...