Splunk Search

How to search the Percentage and Count of Total by each range of a rangemap?

slatta
Explorer

I've looked at several posts involving "Percent of Total" and have tried the suggestions, but still can't get exactly the result I'm looking to have.

I would like to have the "range, count, and percentage of the total count" for each range. I've been able to get (range + count) or (range+percentage), but have not been able to have (range + count + percentage) all together.

index="view" Activity="viewdocument" | eventstats sum(count) as total | rangemap field=Duration "0-3sec"=0-3000, "3-6sec"=3001-6000, "6-10sec"=6001-10000, "10-15sec"=10001-15000, "15-20sec"=15001-20000, "20-25sec"=20001-25000, default=">25sec"  | stats count as counter by range | eval percent=round(counter/total, 2) 

jensonthottian
Contributor

Try the search below:

index="view" Activity="viewdocument"  
| rangemap field=Duration "0-3sec"=0-3000, "3-6sec"=3001-6000, "6-10sec"=6001-10000, "10-15sec"=10001-15000, "15-20sec"=15001-20000, "20-25sec"=20001-25000, default=">25sec"  
| stats count as Count count(eval(range="0-3sec")) as 0to3sec count(eval(range="3-6sec")) as 3to6sec count(eval(range="6-10sec")) as 6to10sec count(eval(range="10-15sec")) as 10to15sec count(eval(range="15-20sec")) as 15to20sec count(eval(range="20-25sec")) as 20to25sec count(eval(range=">25sec")) as grt25sec
| eval Percent0=0to3sec *100/Count 
| eval Percent3=3to6sec*100/Count 
| eval Percent6=6to10sec*100/Count 
| eval Percent10=10to15sec*100/Count 
| eval Percent20=20to25sec*100/Count
| eval Percent25plus=grt25sec*100/Count
Get Updates on the Splunk Community!

Introducing Splunk Enterprise 9.2

WATCH HERE! Watch this Tech Talk to learn about the latest features and enhancements shipped in the new Splunk ...

Adoption of RUM and APM at Splunk

    Unleash the power of Splunk Observability   Watch Now In this can't miss Tech Talk! The Splunk Growth ...

Routing logs with Splunk OTel Collector for Kubernetes

The Splunk Distribution of the OpenTelemetry (OTel) Collector is a product that provides a way to ingest ...