My search shows each website category and the number of times each category was visited. What I would like to create is a table that shows the percentage of all events by category rather than the count. I don't know why, but I'm getting no results found
with my existing SPL.
sample data
category count
streaming 50
reference 13
social media 150
gaming 37
desired output
category percentage
streaming 25.0
reference 6.5
social media 75.0
gaming 18.5
current SPL
index=web
| stats count as grand_total
| stats count by category as cat_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
@DEAD_BEEF , are you looking for something like the following?
index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
@DEAD_BEEF , are you looking for something like the following?
index=web
| stats count as cat_total by category
| eventstats sum(cat_total) as grand_total
| eval percentage = round((cat_total/grand_total)*100,1)
| table category percentage
Exactly what I was looking for. I didn't think of using the value from stats and passing it to eventstats. Thank you!!