topic Re: Mathematic manipulation on 2 separate seraches in Splunk Search

Mathematic manipulation on 2 separate seraches

ramic — Wed, 08 Jan 2014 07:54:04 GMT

I want to perform mathematic manipulations on 2 unrelated search results.

i.e. I want to take a result like:
source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x" | stats count as A

and divide it by a completely new search result:
source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y" | stats count as B

A/B

Re: Mathematic manipulation on 2 separate seraches

ddarmand — Wed, 08 Jan 2014 08:05:52 GMT

You can use multisearch for this

| multisearch [search index=a sourcetype="a" | eval type="A"] [search index=b sourcetype=b | eval type="B"]

Re: Mathematic manipulation on 2 separate seraches

gfuente — Wed, 08 Jan 2014 08:12:13 GMT

Maybe it will perform better with just one search, like:

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

Regards

Re: Mathematic manipulation on 2 separate seraches

ddarmand — Wed, 08 Jan 2014 08:27:05 GMT

It works but parenthesis are wrong

(source="xxxx" sourcetype="xxx" eventType="xxx" clientVersion="x.x.x") OR (source="yyyy" sourcetype="yyy" eventType="yyy" clientVersion="y.y.y") | stats count(eval(if(clientVersion="x.x.x",1,null))) as A, count(eval(if(clientVersion="y.y.y",1,null))) as B | eval Results = A/B

Re: Mathematic manipulation on 2 separate seraches

gfuente — Wed, 08 Jan 2014 08:31:17 GMT

You are right

Re: Mathematic manipulation on 2 separate seraches

ramic — Wed, 08 Jan 2014 09:20:22 GMT

Thank you both, this works.
Still haven't figured how to manipulate multisearch results, used single search instead.