Splunk Search

Calculate totals and then sort based on a field and separate out results

dwong2
New Member

accountId: 12345678

action: Test
publishId: 123 or 456
tile: Tile1

How can I get this result: [accountID that has a tile=* value divided by the total number of total accountId's returned sorted by publishId 123 and 456 ]? Not all accountId's will have a tile value.

Tags (1)
0 Karma

DalJeanis
SplunkTrust
SplunkTrust

Try this -

your search that returns the events
| stats count(accountId) as CountAccounts count(tile) as CountTiles by publishId
| eval percent=round(100*CountTiles/CountAccounts,0)
0 Karma

dwong2
New Member

Is CountTiles the total tile count...is that right? I'm looking for the number of accountId's that have tile= Not all accountId's have a tile value associated with it.

Also is there a way to just sort on the publishId so that I get only 2 results sorted by publishId? Again a wildcard.

i.e.
publishId="*123 and publishId=*456

0 Karma
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...