Answers for "How to calculate the percentage from a dc count?"
https://answers.splunk.com/answers/585614/how-to-calculate-the-percentage-from-a-dc-count-1.html
The latest answers for the question "How to calculate the percentage from a dc count?"Answer by elliotproebstel
https://answers.splunk.com/answering/585628/view.html
The `eventstats sum()` portion of the answer from @cmerriman doesn't work on my system. This does:
`...| stats dc(host) AS total_hosts BY category | addcoltotals labelfield=category label="Total" | eventstats max(total_hosts) AS all_totals | search NOT category="Total" | eval Percentage=tostring(round(total_hosts/all_totals*100,2))."%" | fields - total_hosts all_totals`
*Note: I changed the first stats command there because I find it easier to not use field names with spaces in them until the final portion of a search. I get easily confused about when things need to be wrapped in single quotes, etc. YMMV*Tue, 24 Oct 2017 19:03:55 GMTelliotproebstelAnswer by cmerriman
https://answers.splunk.com/answering/585619/view.html
try this:
..| stats dc(host) as Total_Hosts BY category|eventstats sum(Total_Hosts) as Grand_Total|eval Percent_Total=round(Total_Hosts/Grand_Total*100,2)|fields - Total_Hosts Grand_TotalTue, 24 Oct 2017 18:23:01 GMTcmerriman