Splunk Search

## Top to a sum

Communicator

Hello!
I try to make the sum of a field, but then need to get the percentage occupied by each of the first 4, and% occupying all others, ie get something like this:

``````**Service**    **SumMB**        **percent**
HHTP            90               25.71
HTTPS           85               22.45
DNS             81               21.09
SMTP            70               16.90
Otros           23               13.85
``````

I tried something like this, but that would be missing something but, as you could?

``````SEARCH | stats sum(MB) AS SumMB by service | top SumMB otherstr="Others"
``````

:)

Tags (3)
1 Solution
Champion

"Others" is displayed if I assume it "useother=true". However, I think that this isn't the result that you expect.

``````SEARCH | stats sum(MB) AS SumMB by service | top SumMB useother=true otherstr="Others"
``````

I think that it is necessary to calculate percent by oneself.

For example
SEARCH | stats sum(MB) AS SumMB by service |sort - SumMB|eval id=1|accum id|eval Service=if(id<=4,service,"OTHER")|stats sum(SumMB) as SumMB by Service|addcoltotals labelfield=Service label=ALL|sort - SumMB|eval Total=IF(Service="ALL",SumMB,0)|accum Total|WHERE Service!="ALL"|eval percent=SumMB/Total*100|fields - Total

comment

|sort - SumMB|eval id=1|accum id|eval Service=if(id<=4,service,"OTHER")|->extract TOP4 and "OTHER"
|addcoltotals labelfield=Service label=ALL|sort - SumMB|eval Total=IF(Service="ALL",SumMB,0)|accum Total|WHERE Service!="ALL"|->Calculation of the total

When there is little number, you may demand total by a subsearch.

Champion

"Others" is displayed if I assume it "useother=true". However, I think that this isn't the result that you expect.

``````SEARCH | stats sum(MB) AS SumMB by service | top SumMB useother=true otherstr="Others"
``````

I think that it is necessary to calculate percent by oneself.

For example
SEARCH | stats sum(MB) AS SumMB by service |sort - SumMB|eval id=1|accum id|eval Service=if(id<=4,service,"OTHER")|stats sum(SumMB) as SumMB by Service|addcoltotals labelfield=Service label=ALL|sort - SumMB|eval Total=IF(Service="ALL",SumMB,0)|accum Total|WHERE Service!="ALL"|eval percent=SumMB/Total*100|fields - Total

comment

|sort - SumMB|eval id=1|accum id|eval Service=if(id<=4,service,"OTHER")|->extract TOP4 and "OTHER"
|addcoltotals labelfield=Service label=ALL|sort - SumMB|eval Total=IF(Service="ALL",SumMB,0)|accum Total|WHERE Service!="ALL"|->Calculation of the total

When there is little number, you may demand total by a subsearch.

Communicator  