Summing of row in a column on condition

[vinay_ks04]

I have three columns

ColumnA     ColumnB     ColumnC
vin          1            1
vin          1            2 
vin          2            3
kum          1            1
kum          1            2
kum          2            3

I wanted sum columnc and find out the percentage by ColumnA

ColumnA     ColumnB     ColumnC     "Totalof Columnc by Site" Percentage
vin          1            3              6                       50
             2            3              6                       50
kum          1            3              6                       50
             2            3              6                       50      

[David]

Based on your result, it looks like you want to add something like this to the end of your search:

| stats sum(ColumnC) as "Total of ColumnC by Site" by ColumnA, ColumnB | eventstats sum(ColumnC) as OverallColumnCTotal | eval Percentage = round("Total of ColumnC by Site" / OverallColumnCTotal * 100,0) | table ColumnA ColumnB ColumnC "Total of ColumnC by Site" Percentage

Does that match what you're looking for?

[vinay_ks04]

Thanks a lot 🙂
I have added extra columnname in stats, below is my query.

index="autolab_prod" sourcetype="Percentage_Usage_Config" | stats sum(taskcount) as TOTAL_Task by Site ConfigID CONFIG | eventstats sum(TOTAL_Task) as SiteTotal by Site | eval percent=round(100*TOTAL_Task/SiteTotal,0) | stats list(ConfigID) AS "CONFIG ID", list(CONFIG) AS CONFIGNAME, list(TOTAL_Task) AS "TASK_TOTAL", list(SiteTotal) AS TASK_TOTAL_COUNT, list(percent) as PERCENTAGE by Site

[vinay_ks04]

thank you,
yes, but I am not able to add one more column.

[lguinn2]

Try this

yoursearchhere
| stats sum(ColumnC) as CTotal by ColumnA ColumnB  
| eventstats sum(CTotal) as SiteTotal by ColumnA
| eval Percentage = round(CTotal*100/SiteTotal,0)

[lguinn2]

After the stats command, your search pipeline no longer has any fields except the ones that are the result of the command: TOTAL_Task Site and ConfigID

So if you want the CONFIG to be included, you will have to include it in the by clause of the stats command.

[vinay_ks04]

Thanks a lot it is working.......

I am adding one more column to just print the value which is there in the log, but it is not printing.
I am using "list(Config) As "Config Name"

index="autolab_prod" sourcetype="Percentage_Usage_Config" | stats sum(taskcount) as TOTAL_Task by Site ConfigID | eventstats sum(TOTAL_Task) as SiteTotal by Site | eval percent=round(100*TOTAL_Task/SiteTotal,0) | stats list(ConfigID) AS "CONFIG ID", list(CONFIG) AS "CONFIG NAME", list(TOTAL_Task) AS "TOTAL_Task", list(SiteTotal) AS SiteTotal, list(percent) as PERCENTAGE by Site