I run the following every morning, but I know it could be accomplished more efficiently using tstats, but I cannot get the top host by percentage of all host.
index=* | top 20 host
The following gives me the top host, but I also want to know the percentage of all the hosts.
| tstats count by host | sort -count
Try this:
| tstats count by host | eventstats sum(count) as total | eval percentage = count/total*100 | fields - total | sort - count | head 20
Try this:
| tstats count by host | eventstats sum(count) as total | eval percentage = count/total*100 | fields - total | sort - count | head 20
All you need to do is read the sort
docs: | sort 0 - count
will work for larger sets.
http://docs.splunk.com/Documentation/Splunk/6.5.1/SearchReference/sort
I suppose that works, my mistake. Thanks!
I downvoted this post because doesn't work on large event sets over 10000 rows