Is your feature request related to a problem?
With top (and rare) commands, it'd be nice to conveniently get percentages. Currently they need to be computed manually with eventstats: stats count() as url_count by url | eventstats sum(url_count) as total | eval perc = 100.0 * url_count / total.
What solution would you like?
A simple implementation would rewrite top with showperc to its equivalent.
source=whatever | top url showperc=true
What alternatives have you considered?
Some more complex eval involving computing counts as a special-case without an eventstats node.
Do you have any additional context?
N/A
Is your feature request related to a problem?
With
top(andrare) commands, it'd be nice to conveniently get percentages. Currently they need to be computed manually witheventstats:stats count() as url_count by url | eventstats sum(url_count) as total | eval perc = 100.0 * url_count / total.What solution would you like?
A simple implementation would rewrite
topwithshowpercto its equivalent.What alternatives have you considered?
Some more complex eval involving computing counts as a special-case without an
eventstatsnode.Do you have any additional context?
N/A