Hey! I am trying to figure out how to aggregate a percentage of the total before another search like this:
eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter by currentPage | eval percent = counter/Total
The percent field is always empty when I try to display it using table, and the variable Total seems to disappear once I get past the stats command. What should I do to preserve that total? Thanks!
Best,
F
The stats will remove all other fields which are not specified. Try something like this
eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter max(Total) as Total by currentPage | eval percent = counter/Total
Since Total field is generated as same value for all events (eventstats without by clause), you can use any aggregation function of splunk to get it (min, max, values, first, last).
The stats will remove all other fields which are not specified. Try something like this
eventName = pageLoad | eventstats count as Total | search currentPage "\/brands\/" | stats count(currentPage) as counter max(Total) as Total by currentPage | eval percent = counter/Total
Since Total field is generated as same value for all events (eventstats without by clause), you can use any aggregation function of splunk to get it (min, max, values, first, last).
Amazing. Thanks so much 🙂