Splunk Search

multiple stats count function in the same search component

palisetty
Communicator

@gcusello
I have multiple count functions in the same search component. What does it mean by that? What is really happening here?
| stats count(vendor_action) as ActionEvents, count as TotalEvents

I can definitely understand count(vendor_action) as ActionEvents. What is this part count as TotalEvents saying in regards to the first count?

Tags (1)
0 Karma

jpolvino
Builder

The first count is counting up the events that have a vendor_action field. The second count is counting up the total number of events.

You can use this to calculate a percentage, for example:

| stats count(vendor_action) as ActionEvents, count as TotalEvents
| eval message="Vendor action events account for ".round(ActionEvents/TotalEvents*100,1)."% of the total volume"
0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!