Splunk Search

Top percentage out of total events

Yancy
Path Finder

When using the fields sidebar, I can see how often a field appears out of my total result set (ie Appears in 62% of results), and how often the top values of that field appear in the results.

When I use the top command, I can see how often these values appear out of the total number of events that contain that field.

How can I obtain statistics similar how the field sidebar presents them, as a percentage of the total result set?

In my use case I have UserAgent split out to multiple fields and want to know what are the top UserAgents across our total traffic.

Tags (2)
0 Karma
1 Solution

Ron_Naken
Splunk Employee
Splunk Employee

Here are a couple working options to help with ideas (replace ... with your search):

... | eventstats count AS total | stats first(total) AS total count AS c by UserAgent | eval  perc=(c/total)*100 | fields - total | sort - perc | head 10

or

... | eventstats count AS total | chart eval(count/first(total)) AS perc BY UserAgent | sort - perc

View solution in original post

Ron_Naken
Splunk Employee
Splunk Employee

Here are a couple working options to help with ideas (replace ... with your search):

... | eventstats count AS total | stats first(total) AS total count AS c by UserAgent | eval  perc=(c/total)*100 | fields - total | sort - perc | head 10

or

... | eventstats count AS total | chart eval(count/first(total)) AS perc BY UserAgent | sort - perc
*NEW* Splunk Love Promo!
Snag a $25 Visa Gift Card for Giving Your Review!

It's another Splunk Love Special! For a limited time, you can review one of our select Splunk products through Gartner Peer Insights and receive a $25 Visa gift card!

Review:





Or Learn More in Our Blog >>