如何用单个Splunk查询生成多时间范围报表并显示百分比

当然可行！你已经找对了方向，只是需要补充百分比的计算逻辑——原top命令会自动帮你计算占比，但用stats时得手动实现这个逻辑，下面一步步帮你解决：

一、解决百分比显示问题 #

原top命令的百分比是当前MachineIdentifier的出现次数占该时间范围总事件数的比例，所以我们需要先算出每个时间范围的总事件数，再用单个MachineIdentifier的计数除以总数量得到百分比。

修改后的查询如下：

index="a" env="test" MachineIdentifier source="D:\\Inetpub\\Logs\\app*.log" earliest=-3d@d latest=-1d@d 
| eval marker=case(
    _time >= relative_time(now(), "-2d@d") AND _time < relative_time(now(), "-1d@d"), "1DayData",
    _time >= relative_time(now(), "-3d@d") AND _time < relative_time(now(), "-1d@d"), "2DaysData"
)
| where isnotnull(marker)
| stats count(eval(marker="1DayData")) AS 1DayCount, count(eval(marker="2DaysData")) AS 2DaysCount by MachineIdentifier
| eventstats sum(1DayCount) AS Total1Day, sum(2DaysCount) AS Total2Days
| eval 
    1DayPct=round((1DayCount/Total1Day)*100, 2),
    2DaysPct=round((2DaysCount/Total2Days)*100, 2)
| sort MachineIdentifier asc
| fields MachineIdentifier 1DayCount 1DayPct 2DaysCount 2DaysPct

关键逻辑说明： #

• 用case代替多次append：只需要扫描一遍数据，通过时间判断给每条事件打上对应的时间范围标记，比多次重复搜索更高效
• eventstats计算总事件数：它会把每个时间范围的总计数添加到每一行，方便后续计算单个MachineIdentifier的占比
• round函数：控制百分比的小数位数，和top默认的显示效果一致
• fields命令：只保留需要的字段，让报表更简洁清晰

二、扩展到更多时间范围（比如7天、1个月） #

如果要添加更多时间维度，只需要在case里增加判断条件，然后在stats和后续的计算里对应扩展字段即可。比如添加7天、1个月的数据：

index="a" env="test" MachineIdentifier source="D:\\Inetpub\\Logs\\app*.log" earliest=-30d@d latest=-1d@d 
| eval marker=case(
    _time >= relative_time(now(), "-2d@d") AND _time < relative_time(now(), "-1d@d"), "1DayData",
    _time >= relative_time(now(), "-3d@d") AND _time < relative_time(now(), "-1d@d"), "2DaysData",
    _time >= relative_time(now(), "-8d@d") AND _time < relative_time(now(), "-1d@d"), "7DaysData",
    _time >= relative_time(now(), "-31d@d") AND _time < relative_time(now(), "-1d@d"), "1MonthData"
)
| where isnotnull(marker)
| stats 
    count(eval(marker="1DayData")) AS 1DayCount,
    count(eval(marker="2DaysData")) AS 2DaysCount,
    count(eval(marker="7DaysData")) AS 7DaysCount,
    count(eval(marker="1MonthData")) AS 1MonthCount 
    by MachineIdentifier
| eventstats 
    sum(1DayCount) AS Total1Day,
    sum(2DaysCount) AS Total2Days,
    sum(7DaysCount) AS Total7Days,
    sum(1MonthCount) AS Total1Month
| eval 
    1DayPct=round((1DayCount/Total1Day)*100, 2),
    2DaysPct=round((2DaysCount/Total2Days)*100, 2),
    7DaysPct=round((7DaysCount/Total7Days)*100, 2),
    1MonthPct=round((1MonthCount/Total1Month)*100, 2)
| sort MachineIdentifier asc
| fields MachineIdentifier *Count *Pct

这样就能一次性生成包含多个时间范围的计数和百分比报表啦～

内容的提问来源于stack exchange，提问作者PSR