Charting top 5 events as a percentage of all events

Comments

4 comments

  • Official comment
    Avatar
    Matt Sullivan

    try this out, not sure if it's the most efficient way, but worked for me, of course using a different source category matching our test data.

    _sourceCategory=CategoryICareAbout
    | count event_id
    | total(_count)
    | sort _count
    | limit 6
    | 1 as rownum
    | accum rownum
    | _count/_total as percent
    | total(percent) as totalpercent
    | 1 - totalpercent as remainingpercent
    | if ((_accum=6), "others", event_id) as event_id
    | if ((_accum=6), remainingpercent+percent, percent) as percent
    | fields event_id, percent
  • Avatar
    Matt Sullivan

    hopefully no one used the first version I posted above. Just edited to replace the 2nd to last line as follows:

    | if ((_accum=6), remainingpercent+percent, percent) as percent
  • Avatar
    Matt Sullivan

    A version that does counts as well as %, as I just realized that was desired:

    _sourceCategory=CategoryICareAbout
    | count as occurrences by event_id
    | total(occurrences) as totaloccurrences
    | sort occurrences
    | limit 6
    | total(occurrences) as top6occurrences
    | 1 as rownum
    | accum rownum
    | if ((_accum=6), "others", event_id) as event_id
    | if ((_accum=6), totaloccurrences-top6occurrences+occurrences, occurrences) as occurrences
    | fields event_id, occurrences

    Sample Pie Results:

     

  • Avatar
    Nicholas Sandmann

    Thank you!

     

    Actually the 1st one works fine for my needs.  Relying on Sumo's charting functionality to provide the percentages is fine for my needs since this is just needed for a dashboard. 

    Actually calc'ing the percentages in the raw data is nice to have too though!

Please sign in to leave a comment.