Splunk Search

using streamstats and stats together

elenzil
Path Finder

i'd like to produce a field per event that's the running sum of some field as a percentage of the total sum of that field over the whole search.

for example, if this were excel, my sheet would look something like this:

+-----------------------+---------------+-------------+
| original field values | running total | what i want |
+-----------------------+---------------+-------------+
|                     1 |             1 |         20% |
|                     1 |             2 |         40% |
|                     1 |             3 |         60% |
|                     1 |             4 |         80% |
|                     1 |             5 |        100% |
+-----------------------+---------------+-------------+

i see that streamstats or accum can generate my "running total" column,
but to get my "what i want" column, i need the output of stats c() or stats sum(),
which destroys the individual events.

i feel like it might be a job for a sub-search and appendcols, but i haven't been able to work it out.

thanks in advance,
orion

0 Karma

mzorzi
Splunk Employee
Splunk Employee

index=_internal | head 5 | eval value=1 | eventstats sum(value) as total | streamstats window=0 sum(value) as sumvalue | eval percentage=(sumvalue*100/total) | table value,sumvalue,total,percentage

value sumvalue total percentage
1 1 5 20
1 2 5 40
1 3 5 60
1 4 5 80
1 5 5 100

Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...