topic How do I use a stats sum and then divide by a field not used when summing? in Splunk Search

How do I use a stats sum and then divide by a field not used when summing?

riotto — Tue, 29 Sep 2020 13:05:39 GMT

I have events that have

tablespace, tablespace_size, table_owner, table_name, table_size

ie
WORK_TS 10000000 joe Joe_table1 1000
WORK_TS 10000000 joe Joe_table2 5000
WORK_TS 10000000 mary Mary_table1 3000
WORK_TS 10000000 mary Mary_table2 7000
PROD_TS 10000000 joe Joe_table3 1000
PROD_TS 10000000 joe Joe_table4 5000
PROD_TS 10000000 mary Mary_table3 3000
PROD_TS 10000000 mary Mary_table4 7000

I want to sum the total space used in a tablespace by the table_owner, tablespace and then divide that sum by the tablespace_size

index="oracle" source="oracle_tables" | stats sum(table_size) as owner_used_space by table_owner, tablespace

I get the sums but cannot divide by them by the tablespace_size

Re: How do I use a stats sum and then divide by a field not used when summing?

somesoni2 — Thu, 02 Mar 2017 22:25:51 GMT

Try like this

index="oracle" source="oracle_tables" | stats sum(table_size) as owner_used_space max(tablespace_size) as tablespace_size  by table_owner, tablespace | eval percent_owner_used_space=round(owner_used_space*100/tablespace_size,2)

Re: How do I use a stats sum and then divide by a field not used when summing?

riotto — Thu, 02 Mar 2017 23:34:48 GMT

seems so simple now....Works like a champ!