I would like to display all Bot and Crawler activity compared to the total amount of events.
index="Web"
| eval WebTraffic=if(match(http_user_agent, "(?i)bot"), "Bots", WebTraffic)
| eval WebTraffic=if(match(http_user_agent, "(?i)crawl"), "Crawlers", WebTraffic)
| top WebTraffic
This provides a clear display of my Bots and Crawlers count but I would like to show what percentage the counts represent in comparison to all activity within the same time. For example per hour, my Bots are around 5000 events with Crawlers around 10,000, I'm simply looking for a way to show those numbers next to the total 100,000 of activity for the same hour.
Any thoughts on how to make this happen are appreciated.
... View more