I'm currently using the following log statement:
Jun-28 12:00:28 | INFO| [Controller:116] Downloading file content: fileName: [Way Too Easy.pdf]
The intent is to generate a result that lists the top 5 downloads for every month and the percentage of downloads compared to every other event in that month. It would look something along the lines of:
Using the the following search string gets me close to it, but not quite.
eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y") | top limit=5 fileName by Month
See if the following gets you what you need:
eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent
I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.
index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent
See if the following gets you what you need:
eventtype="document-downloads" | top limit=5 fileName by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month fileName count percent
I tested this trying to do the same thing you did, except with the top 5 Windows Event Logs for given months. See the following search.
index=wineventlog| top limit=5 EventCode by date_month | eventstats sum(count) as sum by date_month | eval percent=count/sum | table date_month EventCode count percent
It was close, this is what I ended up with:
eventtype="document-downloads" | eval Month=strftime(_time,"%m/%Y")
| top limit=10 fileName by Month
| stats list(*) as * by Month
| table Month fileName count percent