https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119171#M184024 <P>Something like this?</P> <PRE><CODE>base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%" </CODE></PRE> Sun, 19 Jan 2014 21:17:28 GMT martin_mueller 2014-01-19T21:17:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119170#M184023 <P>Hi, </P> <P>I am getting requests by host (if we have 20 hosts) then i have 20 values. Now i want to calculate the percentage delta for each host with the average number of requests for all the host. So i got the average hosts for all the hosts and using stats i got the requests per each host. But now how do i calculate percentage delta for each host. Here is the query i have. <BR /> i have eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100<BR /> but i need somekind of for loop so that i get the RequestsPctDelta for each host? any suggestions would help a lot. Thank you. </P> <P>| stats count as requests | eval AverageRequests= requests/20 | stats count as RequestPerHost by host | eval RequestsPctDelta = ((RequestPerHost-AverageRequests)/AverageRequests)*100 | table RequestsPctDelta </P> Sun, 19 Jan 2014 21:13:36 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119170#M184023 xvxt006 2014-01-19T21:13:36Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119171#M184024 <P>Something like this?</P> <PRE><CODE>base search | stats count by host | eventstats avg(count) as avg | eval delta = ((count/avg-1)*100)."%" </CODE></PRE> Sun, 19 Jan 2014 21:17:28 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119171#M184024 martin_mueller 2014-01-19T21:17:28Z https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119172#M184025 <P>Thank you so much Marti. This is what i wanted.</P> Mon, 20 Jan 2014 22:03:42 GMT https://community.splunk.com/t5/Splunk-Search/How-to-calculate-percentages-for-multi-valued-search/m-p/119172#M184025 xvxt006 2014-01-20T22:03:42Z