Hi everyone,
I need your help. My current search is like this:
index="ihs_test" uri_path="*.jhtml" OR uri_path="*.html" | transaction clientip | search bytes!="-" | stats sum(bytes) as total_usebytes |appendcols [search index="ihs_test" uri_path="*.jhtml" OR uri_path="*.html" | transaction clientip | search bytes!="-" | stats sum(bytes) as total_usebytes_by_uri_path by uri_path] | eval percentage=total_usebytes_by_uri_path/total_usebytes
I need to know the percentage of total bytes used for every page in the top 10. How do I do this?
Try this
index="ihs_test" uri_path="*.jhtml" OR uri_path="*.html"
| transaction clientip
| search bytes!="-"
| stats sum(bytes) as as total_usebytes_by_uri_path by uri_path
| eventstats sum(total_usebytes_by_uri_path) as total_usebytes
| eval percentage=total_usebytes_by_uri_path/total_usebytes
| sort 10 -percentage
Without the subsearch, this should run dramatically faster. Why do you need the transaction
command at all?
Hi @dovelsh12223621
Just following up with this post, but did @lguinn's search below answer your question? If yes, don't forget to resolve the post by clicking "Accept" directly below her answer and upvote it by clicking the up arrow to the left of the answer.
Try this
index="ihs_test" uri_path="*.jhtml" OR uri_path="*.html"
| transaction clientip
| search bytes!="-"
| stats sum(bytes) as as total_usebytes_by_uri_path by uri_path
| eventstats sum(total_usebytes_by_uri_path) as total_usebytes
| eval percentage=total_usebytes_by_uri_path/total_usebytes
| sort 10 -percentage
Without the subsearch, this should run dramatically faster. Why do you need the transaction
command at all?