topic Re: Divide the results of a query based on a field in the log in Splunk Search

Divide the results of a query based on a field in the log

SG — Thu, 27 May 2021 11:40:34 GMT

Hi,

I wanted to divide each hostname by using the count of "documentcompletetime" field.

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" | chart count(url) by hostname

The output of the query is as below...

The count(url) column I wanted to divide with the count of "documentcompletetime" field. This field is available in the events, screenshot for the same

I wanted to divide each and every value of count(url) column with "documentcompletetime" count which is 48 in this example. documentcompletetime value is not a static value. The value changes based on the test timings. Can you guys please help?

Re: Divide the results of a query based on a field in the log

aasabatini — Thu, 27 May 2021 12:01:06 GMT

Hi @SG

can you show the values of the documentcompletetime field?

also did you try this?

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" | chart count(url) by hostname documentcompletetime

Re: Divide the results of a query based on a field in the log

SG — Thu, 27 May 2021 12:22:10 GMT

@aasabatini

With the query provided by you, i am just getting the count of url by host name

hostname	NULL
cdn.appdynamics.com	47
digitalcontent.api.tesco.com	658
o505202.ingest.sentry.io	61
pdx-col.eum-appdynamics.com	1
smetrics.tesco.com	47
www.bing.com	705
www.googletagmanager.com	49
www.***.com	686

I also wanted to divide each and every value in the null column with the count of "documentcompletetime" .

For example

hostname	NULL	documentcompletetime	count(url)
cdn.appdynamics.com	47	48	0.979167
digitalcontent.api.tesco.com	658	48	13.70833
o505202.ingest.sentry.io	61	48	1.270833
pdx-col.eum-appdynamics.com	1	48	0.020833
smetrics.tesco.com	47	48	0.979167
www.bing.com	705	48	14.6875
www.googletagmanager.com	49	48	1.020833
www.**.com	686	48	14.29167

Re: Divide the results of a query based on a field in the log

aasabatini — Fri, 28 May 2021 06:21:24 GMT

Hi @SG

got it!

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage" | eventstats dc(documentcompletetime) as documentcompletetime | stats count(url) as count values(documentcompletetime) as documentcompletetime by hostname | eval division=count/documentcompletetime | table hostname count documentcompletetime division

Re: Divide the results of a query based on a field in the log

SG — Fri, 28 May 2021 09:39:03 GMT

Thanks to @aasabatini for the response, this is what i was looking for