Splunk Search

How do you tabulate a percentage of field value in a table?

DEAD_BEEF
Builder

My search shows each website category and the number of times each category was visited. What I would like to create is a table that shows the percentage of all events by category rather than the count. I don't know why, but I'm getting no results found with my existing SPL.

sample data

category      count
streaming     50
reference     13
social media  150
gaming        37

desired output

category      percentage
streaming     25.0
reference     6.5
social media  75.0
gaming        18.5

current SPL

index=web
| stats count as grand_total
| stats count by category as cat_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
0 Karma
1 Solution

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

View solution in original post

niketn
Legend

@DEAD_BEEF , are you looking for something like the following?

index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total 
| eval percentage = round((cat_total/grand_total)*100,1) 
| table category percentage
____________________________________________
| makeresults | eval message= "Happy Splunking!!!"

becksyboy
Communicator

Thanks, just what i was looking for.

Tags (1)
0 Karma

DEAD_BEEF
Builder

Exactly what I was looking for. I didn't think of using the value from stats and passing it to eventstats. Thank you!!

Get Updates on the Splunk Community!

.conf24 | Registration Open!

Hello, hello! I come bearing good news: Registration for .conf24 is now open!   conf is Splunk’s rad annual ...

ICYMI - Check out the latest releases of Splunk Edge Processor

Splunk is pleased to announce the latest enhancements to Splunk Edge Processor.  HEC Receiver authorization ...

Introducing the 2024 SplunkTrust!

Hello, Splunk Community! We are beyond thrilled to announce our newest group of SplunkTrust members!  The ...