Splunk Search

How to generate a search that displays a cumulative percentage column?

kualo
Explorer

Hi I have the log below.

           score
1              10     
2              22
3              33
4              36
5              55

Each event has a score range from 0~50
I want to have a cumulative percentage column showing that

greater or equal 40 : 20% 
greater or equal 30 : 60%
greater or equal 20 : 80%
greater or equal 10 : 100%
greater or equal  0 : 100%
0 Karma

sundareshr
Legend

Try this

... | bin span=10 score | stats count by score | eventstats sum(count) as total | eval percentage=round(count/total, 0)*100 | eval percentage=tostring(percentage, "commas")."%" | replace * WITH "greater or equal to "* IN score | table score percentage
0 Karma
Get Updates on the Splunk Community!

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...

Get ready to show some Splunk Certification swagger at .conf24!

Dive into the deep end of data by earning a Splunk Certification at .conf24. We're enticing you again this ...

Built-in Service Level Objectives Management to Bridge the Gap Between Service & ...

Now On-Demand Join us to learn more about how you can leverage Service Level Objectives (SLOs) and the new ...