Splunk Search

Top percentage out of total events

Yancy
Path Finder

When using the fields sidebar, I can see how often a field appears out of my total result set (ie Appears in 62% of results), and how often the top values of that field appear in the results.

When I use the top command, I can see how often these values appear out of the total number of events that contain that field.

How can I obtain statistics similar how the field sidebar presents them, as a percentage of the total result set?

In my use case I have UserAgent split out to multiple fields and want to know what are the top UserAgents across our total traffic.

Tags (2)
0 Karma
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Here are a couple working options to help with ideas (replace ... with your search):

... | eventstats count AS total | stats first(total) AS total count AS c by UserAgent | eval  perc=(c/total)*100 | fields - total | sort - perc | head 10

or

... | eventstats count AS total | chart eval(count/first(total)) AS perc BY UserAgent | sort - perc

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

Here are a couple working options to help with ideas (replace ... with your search):

... | eventstats count AS total | stats first(total) AS total count AS c by UserAgent | eval  perc=(c/total)*100 | fields - total | sort - perc | head 10

or

... | eventstats count AS total | chart eval(count/first(total)) AS perc BY UserAgent | sort - perc

View solution in original post


Tune In & Win!

Don't miss out on your
chance to take home free
prizes by helping our players
save the Splunk Cloudom!

Dungeons & Data
Monsters: Splunk O11y
Day Editions Games
stream live:
5/4 at 6:30pm PST
5/5 at 7:00pm PST
on