https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421037#M120968 <P>How about:<BR /> index=main<BR /> | ...<BR /> | stats earliest(cpu) as total_cpu earliest(start_time) as start_time sum(cpu) as MB by job<BR /> | eval pct = ...</P> Tue, 29 Sep 2020 22:15:40 GMT whrg 2020-09-29T22:15:40Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421030#M120961 <P>I'm trying to calculate the percentage of resources that are consumed by a job based on the start time of the job.<BR /> Each job has more than one event and startTime could vary in the events. So I'm considering the earliest start time of the job.<BR /> Using eventstats is not producing the events which im looking at.</P> <P>stats earliest(start_time) as start_time by job, If this is replaced in the place of eventstats im getting the results what I want.</P> <P>Can someone assist me on this?</P> <PRE><CODE>index=main | search trainId=acggalladks" | eventstats earliest(start_time) as start_time by job | stats first(cpu) as total_cpu sum(cpu) as MB by start_time, job | eval pct = round((MB/total_cpu)*100, 2) | table pct job </CODE></PRE> Tue, 29 Sep 2020 22:16:33 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421030#M120961 bollam 2020-09-29T22:16:33Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421031#M120962 <P>Just to clarify: Let us assume your events are (please add any missing fields):<BR /> job,start_time,cpu<BR /> Job A, 6am, 25<BR /> Job A, 7am, 35<BR /> Job A, 8am, 30<BR /> Job B, 8am, 10<BR /> Then what output do you want from the search?<BR /> And how do you calculate total_cpu?</P> Tue, 29 Sep 2020 22:14:37 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421031#M120962 whrg 2020-09-29T22:14:37Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421032#M120963 <P>The total_cpu is the common for all the events.</P> <P>I'm adding another row for job B which is job B 6am<BR /> I want output to be as below.<BR /> Job A, 6am, 25 pct_value<BR /> job B, 6am, 10 pct_value</P> Tue, 29 Sep 2020 22:16:59 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421032#M120963 bollam 2020-09-29T22:16:59Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421033#M120964 <P>I tried this query and it's giving me the output what im looking at. But is it possible to get the output without join command?</P> <P>index=main <BR /> | search trainId="somevalue" <BR /> | join start_time<BR /> [ search index=main <BR /> | search trainId="somevalue" <BR /> | stats earliest(start_time) as start_time by job <BR /> | table start_time ] <BR /> | stats first(cpu) as total_cpu sum(cpu) as MB by start_time, job<BR /> | eval pct = round((MB/total_cpu)*100, 2)<BR /> | table start_time pct job</P> Tue, 29 Sep 2020 22:17:01 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421033#M120964 bollam 2020-09-29T22:17:01Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421034#M120965 <P>remove join and see you get the same results (why you are using join),</P> <P>try this, I think you are expecting below the search<BR /> index=main <BR /> | search trainId=acggalladks"<BR /> | stats earliest(cpu) as total_cpu sum(cpu) as MB by job<BR /> | eval pct = round((MB/total_cpu)*100, 2)<BR /> | table pct job</P> Tue, 29 Sep 2020 22:15:26 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421034#M120965 nagarjuna280 2020-09-29T22:15:26Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421035#M120966 <P>index=main <BR /> | search trainId="somevalue" <BR /> | stats earliest(start_time) as start_time by job</P> <P>Whatever the output that returns by the field start_time from the above search need to be used in the by clause for the below query.</P> <P>index=main <BR /> | search trainId="somevalue" <BR /> stats first(cpu) as total_cpu sum(cpu) as MB by start_time, job<BR /> | eval pct = round((MB/total_cpu)*100, 2)<BR /> | table start_time pct job</P> Tue, 29 Sep 2020 22:17:04 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421035#M120966 bollam 2020-09-29T22:17:04Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421036#M120967 <P>use map command</P> Tue, 04 Dec 2018 07:23:34 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421036#M120967 nagarjuna280 2018-12-04T07:23:34Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421037#M120968 <P>How about:<BR /> index=main<BR /> | ...<BR /> | stats earliest(cpu) as total_cpu earliest(start_time) as start_time sum(cpu) as MB by job<BR /> | eval pct = ...</P> Tue, 29 Sep 2020 22:15:40 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421037#M120968 whrg 2020-09-29T22:15:40Z https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421038#M120969 <P><a href="https://community.splunk.com/t5/user/viewprofilepage/user-id/151987">@whrg</a>, That way it won't work because i want the values of the start_time to be used in the by clause.<BR /> I got it solved without join but looking for an optimal way.</P> <P>index=main <BR /> | search trainId="somevalue" <BR /> [ search index=main <BR /> | search trainId="somevalue" <BR /> | stats earliest(start_time) as start_time by job <BR /> | table start_time ] <BR /> | stats first(cpu) as total_cpu sum(cpu) as MB by start_time, job<BR /> | eval pct = round((MB/total_cpu)*100, 2)<BR /> | table start_time pct job</P> Tue, 29 Sep 2020 22:17:07 GMT https://community.splunk.com/t5/Splunk-Search/How-to-aggregate-the-results-based-on-the-results-of-the/m-p/421038#M120969 bollam 2020-09-29T22:17:07Z