Using top to get count and percentage by subgroup

[mschellhouse]

I am using the following code to get a count and percentage breakdown by x and y. I would like the percent returned to be within the subgroup of x rather than percent of the total population.

top limit=0 x y

[somesoni2 · Accepted solution]

Try like this

your base search | stats count by x y | eventstats sum(count) as total by x | eval perc=count*100/total | sort 0 host -count