https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554822#M157478 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture1.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14525i0CEB200AD7D960C2/image-size/large?v=v2&amp;px=999" role="button" title="Capture1.PNG" alt="Capture1.PNG" /></span></P><P>Sure, here is an example</P> Tue, 08 Jun 2021 06:03:32 GMT Rokas_Strazdas 2021-06-08T06:03:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554416#M157370 <P>Following is the data I have:</P><UL><LI>Time (DD/MM/YYYY 00:00:00)</LI><LI>Delay_class (String value, example "B. &gt; 15 MIN" or "A. &lt; 15MIN")</LI><LI>NumberOfOccurances (integer, numeric values of traffic count, for example, "314" or "96606")</LI><LI>Others (Fields that are not important in this case)</LI></UL><P>&nbsp;</P><P>What I am trying to do is to show a ratio of the two delay classes with corresponding time limitations (like the ones seen in the example) based on the number of occurrences.</P><P>So, for example, on the 4th of June all of the combined NumberOfOccurances for the delay class of "B. &gt; 15 MIN" are 50000, while all of the combined (summed) NumberOfOccurances on the same day for a corresponding delay class "A. &lt; 15MIN" are 1000000, so I'd like to see the ratio of 0,05 shown in a Pivot table of visualization of some sort. How do I achieve that?&nbsp;</P> Fri, 04 Jun 2021 06:59:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554416#M157370 Rokas_Strazdas 2021-06-04T06:59:06Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554547#M157398 Can you share couple of line your events? It’s easier to understand and answer to your question. Fri, 04 Jun 2021 20:56:54 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554547#M157398 isoutamo 2021-06-04T20:56:54Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554822#M157478 <P><span class="lia-inline-image-display-wrapper lia-image-align-inline" image-alt="Capture1.PNG" style="width: 999px;"><img src="https://community.splunk.com/t5/image/serverpage/image-id/14525i0CEB200AD7D960C2/image-size/large?v=v2&amp;px=999" role="button" title="Capture1.PNG" alt="Capture1.PNG" /></span></P><P>Sure, here is an example</P> Tue, 08 Jun 2021 06:03:32 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554822#M157478 Rokas_Strazdas 2021-06-08T06:03:32Z https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554846#M157484 <LI-CODE lang="markup">source="CombinedA.csv" host="DESKTOP-NNPLERL" sourcetype="csv" DELAY_CLASS="*325*" | bin span=1d _time | stats sum(NumberOfOccurances) as NumberOfOccurances by _time DELAY_CLASS | eval limitation=substr(DELAY_CLASS,5,len(DELAY_CLASS)-5) | eval class=substr(DELAY_CLASS,1,1) | eval {class}_count=NumberOfOccurances | table limitation _time *_count | stats values(*) as * by _time limitation | eval ratio=A_count/B_count</LI-CODE> Tue, 08 Jun 2021 08:03:45 GMT https://community.splunk.com/t5/Splunk-Search/How-to-get-a-ratio-of-two-fields-based-on-condition/m-p/554846#M157484 ITWhisperer 2021-06-08T08:03:45Z