Splunk Search

percent of results per bin

tp29
Engager

Hi all,

New to splunk, running out of ideas, please help!

I have created a search to show:

| bin span=10m _time

| stat count by _time

This gives me two columns - the time interval in 10 minutes bins, and the number of results within that bin.

What I would like to do is expand on this search and show the % of bins over a time range that have > =10 results 

 

cheers

Labels (6)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust
| bin span=10m _time
| stat count by _time
| stats count(eval(count>=10)) as count10plus count as total
| eval percent=100*count10plus/total

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
| bin span=10m _time
| stat count by _time
| stats count(eval(count>=10)) as count10plus count as total
| eval percent=100*count10plus/total

tp29
Engager

That works perfectly.
Thank you very much 🙏

0 Karma
Get Updates on the Splunk Community!

Preparing your Splunk Environment for OpenSSL3

The Splunk platform will transition to OpenSSL version 3 in a future release. Actions are required to prepare ...

Unleash Unified Security and Observability with Splunk Cloud Platform

     Now Available on Microsoft AzureThursday, March 27, 2025  |  11AM PST / 2PM EST | Register NowStep boldly ...

Splunk AppDynamics with Cisco Secure Application

Web applications unfortunately present a target rich environment for security vulnerabilities and attacks. ...