I am using the following code to get a count and percentage breakdown by x and y. I would like the percent returned to be within the subgroup of x rather than percent of the total population.
top limit=0 x y
Try like this
your base search | stats count by x y | eventstats sum(count) as total by x | eval perc=count*100/total | sort 0 host -count
View solution in original post