Splunk Search

using streamstats and stats together

elenzil
Path Finder

i'd like to produce a field per event that's the running sum of some field as a percentage of the total sum of that field over the whole search.

for example, if this were excel, my sheet would look something like this:

+-----------------------+---------------+-------------+
| original field values | running total | what i want |
+-----------------------+---------------+-------------+
|                     1 |             1 |         20% |
|                     1 |             2 |         40% |
|                     1 |             3 |         60% |
|                     1 |             4 |         80% |
|                     1 |             5 |        100% |
+-----------------------+---------------+-------------+

i see that streamstats or accum can generate my "running total" column,
but to get my "what i want" column, i need the output of stats c() or stats sum(),
which destroys the individual events.

i feel like it might be a job for a sub-search and appendcols, but i haven't been able to work it out.

thanks in advance,
orion

0 Karma

mzorzi
Splunk Employee
Splunk Employee

index=_internal | head 5 | eval value=1 | eventstats sum(value) as total | streamstats window=0 sum(value) as sumvalue | eval percentage=(sumvalue*100/total) | table value,sumvalue,total,percentage

value sumvalue total percentage
1 1 5 20
1 2 5 40
1 3 5 60
1 4 5 80
1 5 5 100

Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...