Splunk Search

multiple stats count function in the same search component

palisetty
Communicator

@gcusello
I have multiple count functions in the same search component. What does it mean by that? What is really happening here?
| stats count(vendor_action) as ActionEvents, count as TotalEvents

I can definitely understand count(vendor_action) as ActionEvents. What is this part count as TotalEvents saying in regards to the first count?

Tags (1)
0 Karma

jpolvino
Builder

The first count is counting up the events that have a vendor_action field. The second count is counting up the total number of events.

You can use this to calculate a percentage, for example:

| stats count(vendor_action) as ActionEvents, count as TotalEvents
| eval message="Vendor action events account for ".round(ActionEvents/TotalEvents*100,1)."% of the total volume"
0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!