I'm charting some events BY Host which gives me the correct counts for each host. I would like to also display a "% Total Requests" on each line, but can't figure out how to capture the total number of requests before renderng the chart. In other words, I need to be able to do:
Requests / Total Requests for each line in the table.
This is the current search, without the Total Requests:
/nepoc_access.log.1" | lookup dnslookup ip AS client_ip | rename host AS Host | chart count(Host) AS Requests, sum(eval(file_size/1000000000)) AS GBytes by Host | sort 100 -Requests
And the Results are:
Host Requests GBytes
1 host1 1382 0.023790
2 host2 1072 0.011972
3 host3 660 0.006896
/nepoc_access.log.1
| lookup dnslookup ip AS client_ip
| rename host AS Host
| chart count(Host) AS Requests, sum(eval(file_size/1000000000)) AS GBytes by Host
| eventstats sum(Requests) as TotalRequests
| eval pctRequests=Requests/TotalRequests
| sort 100 -Requests
Thanks, gkanapathy. It gave me just what I wanted.