If I want to display percentages as well as a count for a table and I want the percentages out of the total count of the table, how do I display that?
|multisearch [search index = blah sourcetype="blah" host=blah | tstats count WHERE index = blah sourcetype="blah" host=blah earliest=@mon
| eval earliest=if(cou... OR ("NAME"="blah") | eval Coast ="EastCoast"]
[search index = blah sourcetype="blah " host=blah
| tstats count WHERE index = blah sourcetype="blah " host=blah earliest=@mon
| eval earliest=if(cou...
OR ("NAME"="blah *") | eval Coast ="WestCoast"]| dedup HOST.IP |stats count(blah) as NumberOfIPs by Coast
Try like this
|multisearch [search index = blah sourcetype="blah" host=blah [| tstats count WHERE index = blah sourcetype="blah" host=blah earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon") | table earliest ]
("NAME"="blah_*") OR ("NAME"="blah") | eval Coast ="EastCoast"]
[search index = blah sourcetype="blah " host=blah
[| tstats count WHERE index = blah sourcetype="blah " host=blah earliest=@mon
| eval earliest=if(count=0,"-1mon@mon","@mon")
| table earliest ]
("NAME"="blah _*") OR ("NAME"="blah *") | eval Coast ="WestCoast"]| dedup HOST.IP |stats count(blah) as NumberOfIPs by Coast
| eventstats sum(NumberOfIPs) as Total
| eval Percentage=round(NumberOfIPs*100/Total,2)
| fields - Total
Thank you!
you could use |top
otherwise you'll have to do some math.
|stats count(_raw) as total
|stats count(x) by x as foo
|eval perc = ((foo / total)*100) + "%"
http://docs.splunk.com/Documentation/Splunk/7.1.2/SearchReference/Top