base search | stats values(srcip) as Source count by catdesc
Above is my search. The results now yield each category description (catdesc) and lists each srcip for the catdesc. How do I break down each srcip by percent of the toal number of events? I need my table to be:
catdesc Source Percent Count
Pornography x.x.x.x 25% 200
y.y.y.y 50%
z.z.z.z 25%
Gaming a.a.a.a 50% 100
b.b.b.b 50%
Thanks.
↧