Splunk Search

Subtotal percentage with stats

dauren_akilbeko
Communicator

I'm working with Windows events, and want to make following report/search:

process1                                                                                                            Total XX XX%
                                                        command_line1 XX%
                                                        command_line2 XX%

process4                                                                                                            Total XX XX%
                                                        command_line1 XX%
                                                        command_line2 XX%

 

What I come up with:

 

 

`index_windows` EventCode=4688 
| fields Process_Command_Line, New_Process_Name 
| stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerProcess by New_Process_Name
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2)
| sort - totalCount

 

 

 

The only thing is that I can't figure out how to merge fields by New_Process_Name

dauren_akilbeko_0-1623837792088.png

 

Labels (3)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
`index_windows` EventCode=4688 
| fields Process_Command_Line, New_Process_Name 
| stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerProcess by New_Process_Name
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2)
| stats list(Process_Command_Line) as Process_Command_line list(percentageTotal) as percentageTotal values(percentagePerProcess) as percentagePerProcess by New_Process_Name
| sort - totalCount

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
`index_windows` EventCode=4688 
| fields Process_Command_Line, New_Process_Name 
| stats count(Process_Command_Line) as totalCount by New_Process_Name, Process_Command_Line
| eventstats sum(totalCount) as _total
| eventstats sum(totalCount) as _totalPerProcess by New_Process_Name
| eval percentageTotal=round((totalCount/_total)*100,2)
| eval precentagePerProcess=round((totalCount/_totalPerProcess)*100,2)
| stats list(Process_Command_Line) as Process_Command_line list(percentageTotal) as percentageTotal values(percentagePerProcess) as percentagePerProcess by New_Process_Name
| sort - totalCount

dauren_akilbeko
Communicator

Thank you, so simple! :face_with_rolling_eyes: Changed list to values though, as it hit the limit.

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

The reason for list rather than values is to keep the count and process in line because values sorts them. If you can't use list, you should consider creating a concatenated field before using values.

Get Updates on the Splunk Community!

See just what you’ve been missing | Observability tracks at Splunk University

Looking to sharpen your observability skills so you can better understand how to collect and analyze data from ...

Weezer at .conf25? Say it ain’t so!

Hello Splunkers, The countdown to .conf25 is on-and we've just turned up the volume! We're thrilled to ...

How SC4S Makes Suricata Logs Ingestion Simple

Network security monitoring has become increasingly critical for organizations of all sizes. Splunk has ...