Splunk Search

how to display percentage of total

BertKraan
Engager

I count all my httpstatus'ses and get a neat result using:

index=prd_access sourcetype="access:web:iis:project" | chart count by httpstatus | addcoltotals count

Using addcoltotals I even have the grand total of all httpstatus'ses.

Now what I would like to do is displaying the http code followed by percentage of the total, something along the lines of:

200 95,9 %

304 3,1 %

404 0,1 %

et cetera

I'm sure this has been done before but can someone point me in the right direction?

Thanks in advance,

Bert

Tags (1)
0 Karma
1 Solution

Ayn
Legend

Using eventstats might be better:

index=prd_access sourcetype="access:web:iis:project" | eventstats count as totalcount | chart count,first(totalcount) as totalcount by httpstatus | eval percentage=count/totalcount

View solution in original post

Ayn
Legend

Using eventstats might be better:

index=prd_access sourcetype="access:web:iis:project" | eventstats count as totalcount | chart count,first(totalcount) as totalcount by httpstatus | eval percentage=count/totalcount

BertKraan
Engager

Great! Thanks for your answer!

(Is there anything like a structured tutorial into the Splunk search/query language?) I didn't hear of eventstats before, but It solves my problem.

Thanks again!

0 Karma
Get Updates on the Splunk Community!

Demo Day: Strengthen Your SOC with Splunk Enterprise Security 8.1

Today’s threat landscape is more complex than ever. Security operation centers (SOCs) are overwhelmed with ...

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...