topic How can I derive a field based on the existing two fields? in Splunk Search

How can I derive a field based on the existing two fields?

newsplnkr — Tue, 04 Dec 2018 04:51:39 GMT

Hello All,

I am new to Splunk, and in need of help for below events:

[testName="MobileExp",experience="FetchOn"]
[testName="MobileExp",experience="FetchOff"]
[testName="ProductDesign",experience="A"]
[testName="ProductDesign",experience="B"]
[testName="ProductDesign",experience="C"]
[testName="ProductDesign",experience="B"]
[testName="ProductDesign",experience="B"]

Using above events, I wanted to derive a field which would have percentage for each "experience" of a "testName". For example, for testName="MobileExp", there are two experiences, each of them appearing exactly once. So, percentage split for the experiences relating to testName="MobileExp" is 50%.

Thank you in advance!

Re: How can I derive a field based on the existing two fields?

renjith_nair — Tue, 04 Dec 2018 06:43:15 GMT

@newsplnkr ,

Try

"your base search "|eventstats count by testName,experience
|eventstats sum(count) as total by testName
|eval perc=round((count/total)*100,2)|fields - count,total

Re: How can I derive a field based on the existing two fields?

newsplnkr — Tue, 04 Dec 2018 13:52:09 GMT

Hi Renjith, unfortunately, the above query does not produce any results.

Re: How can I derive a field based on the existing two fields?

newsplnkr — Tue, 04 Dec 2018 16:51:43 GMT

I figured out the answer with the help of @renjith.nair.

The following worked:

Re: How can I derive a field based on the existing two fields?

macadminrohit — Tue, 04 Dec 2018 16:58:28 GMT

Try this search, replace the base search as per your data :

| makeresults 
| eval Data="testName:MobileExp,experience:FetchOn;testName:MobileExp,experience:FetchOff;testName:ProductDesign,experience:A;testName:ProductDesign,experience:C;testName:ProductDesign,experience:B;testName:ProductDesign,experience:B" 
| makemv delim=";" Data 
| mvexpand Data 
| eval Split1=mvindex(split(Data,","),0) 
| eval Split2=mvindex(split(Data,","),1) | eval testName=mvindex(split(Split1,":"),1) | eval experience=mvindex(split(Split2,":"),1) | table _time testName experience | eventstats count as test_count by testName experience | eventstats sum(test_count) as Total by testName | eval perc=(test_count/Total*100)

Re: How can I derive a field based on the existing two fields?

skoelpin — Tue, 04 Dec 2018 17:10:01 GMT

Accept the answer

Re: How can I derive a field based on the existing two fields?

macadminrohit — Tue, 04 Dec 2018 17:18:40 GMT

question: why you are deduping at the end ?

Re: How can I derive a field based on the existing two fields?

newsplnkr — Thu, 20 Dec 2018 21:35:36 GMT

I did it to remove any duplicate records