How to edit my search to show the count and percentage per id for each day?

[guillecasco]

Hey.

I'm quite new with Splunk and learning for the moment. I need to show a table with " Time id count percentage "
For the last 15 days, I need to know the count of backend calls per id for each day.
I already extracted the Ids from a json file and now just need to show them as the way I described.

I'm trying some things I only have this search:

index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |timechart span=1d count by asset_data{}.id 

but it doesn't show me what I want. It just shows a table with field time and the name of each asset id in other field with the counts of each search on backend like this:

time   id12345  1269785  id9874   
4/11      85       29       5          
4/12      67       35       7    

[somesoni2 · Accepted solution]

Try something like this

index=ips_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data  | bucket _time span=1d | stats count by _time asset_data{}.id | rename asset_data{}.id  as id | eventstats sum(count) as total by _time | eval percentage=round(count*100/total,2) 
| table _time id count percentage

[guillecasco]

I missunderstood the question. Didn't have to put 15 rows for the 15 last days, Just look up in the logs of the last 15 days and extract that information. So final query (With your help somesoni2) is

index=updtr_api earliest=-15d updatesearch | rex field=summary "(?\{.*)" | spath input=json_data |stats count by asset_data{}.id | rename asset_data{}.id  as id|eventstats sum(count) as total| eval percentage=round(count*100/total) |table id count percentage

thank you!

[martin_mueller]

It'd help if you provided some sample data along with a sketch of what your results table should look like.