index=app sourcetype=accesslog uri="some uri" user!="-" (context="display" OR context="pages") earliest=-7d | rex field=page ^"(?\S+)(\/|\?|spaceKey\=|draftId\=|pageId\=|key\=)|(?[0-9|a-z|A-Z|\+\%\-\:\(\)\.]{1,})|\&(?\S+)" max_match=0 | search spacekey_or_action="123" OR (spacekey_or_action="viewpage.action" AND pid_or_sk="123")
| stats dc(user) as users by page
| sort -users
| eventstats sum(users) as totalUsers
I get the display as :
1. Page1 100 150
2. Page2 50 150
Basically, my question is how do i get a % so Page 1 is 66% of total events and Page 2 is 33% of total events and so on
The base rex and this followup rex searches all pages for the content group 123.
↧