Splunk Search

How to edit my search to find percentage of duplicate events?

RocIngersol
Explorer

Hey Folks,

Any suggestions on how to report on the total percent of my events that are duplicates?

I can find my dupes via;

... | eval dupfield=_raw | transaction dupfield maxspan=1s keepevicted=true

But how do I get my dupfield / by my totalevent count? An appended search then an eval? I was thinking there is a better way..perhaps with eventstats first and then piping to transaction...

Thx!

0 Karma
1 Solution

cmerriman
Super Champion

if i understand what you're going for, see if this works.

...| eval dupfield=_raw|stats count by dupfield|eval dupevents=if(count>1,count,0)|stats sum(count) as total sum(dupevents) as dupevents|eval percDup=dupevents/total*100

View solution in original post

0 Karma

cmerriman
Super Champion

if i understand what you're going for, see if this works.

...| eval dupfield=_raw|stats count by dupfield|eval dupevents=if(count>1,count,0)|stats sum(count) as total sum(dupevents) as dupevents|eval percDup=dupevents/total*100
0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...