topic Re: Division of two sums - subfield parsed out of a field in Splunk Search

Division of two sums - subfield parsed out of a field

splunk_zen — Mon, 01 Oct 2012 15:13:28 GMT

Let's say I have a .csv content of the following structure,

PROCESS_5 (qa_cluster1server3),1,100,131,2012-10-01 15:50:00  
PROCESS_6 (qa_cluster2server2),2,100,97,2012-10-01 15:50:00
....

I need to parse the cluster from which the data belongs out of the first comma delimited value,

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server

which gets the following output,

_time                   qa_cluster1 qa_cluster2
01/10/2012 11:00:00.000 17785   34852
01/10/2012 11:05:00.000 17529   35039
....

But how can I get the ratio evolution between each different cluster?
(dividing the sum(EVOCATIONS) of one server by the other)

Re: Division of two sums - subfield parsed out of a field

dwaddle — Mon, 01 Oct 2012 15:59:53 GMT

Use eval something like this:

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?<server>PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2

Re: Division of two sums - subfield parsed out of a field

splunk_zen — Mon, 28 Sep 2020 12:32:16 GMT

Thanks dwadlle.
It IS easy... I was overcomplicating it.
I just had to filter the fields to get the graph I intended.

source=*output/ora_queries/cluster10/processKpis.csv
| rex field=module_name "(?PROCESS[0-9]qa_server)"
| timechart span=2h sum(EVOCATIONS) by server
| eval ratio=qa_cluster1 / qa_cluster2
| fields _time, EvocationRatio