How to get a count and percentage for denied connections in cisco web appliance

Question

I am trying to get the number of denied connections from squid proxy logs from a Cisco Ironport web security appliance.

Using sc_result_code with values: TCP_DENIED, TCP_MISS, TCP_CLIENT_REFRESH_MISS, TCP_MEM_HIT, TCP_REFRESH_HIT, TCP_IMS_HIT, TCP_HIT

I would like to get a table that shows the tcp_denied value as count and a count% and the other values combined with a count and a count %.

Answer 1

1	`... \| eval sc_type = if(sc_result_code == "TCP_DENIED", "TCP_DENIED", "OTHER") \| top sc_type` link answered 11 Apr '12, 08:41 Ayn 25.2k●3●7●17 accept rate: 41%