topic Re: How to do the division of 2 values in the same field in Splunk Search

How to do the division of 2 values in the same field

Julia1231 — Fri, 06 May 2022 14:24:30 GMT

Hi,

I have a table like this:

id value

1 12

2 10

I want to do this calculation by splunk: (10/12)*100% (means value of second id / value of the first id)*100%

How do I do, please?

Re: How to do the division of 2 values in the same field

ITWhisperer — Fri, 06 May 2022 15:08:16 GMT

Calculations are done between fields in events so the first thing you need to do is get both values into the same event. There a number of ways to do this. If you only have two events, try this:

| stats list(value) as value | eval percent=100*mvindex(value,1)/mvindex(value,0)

Re: How to do the division of 2 values in the same field

Julia1231 — Mon, 09 May 2022 08:36:17 GMT

It works well,

Thank you!

Re: How to do the division of 2 values in the same field

Julia1231 — Thu, 19 May 2022 10:08:34 GMT

Hi @ITWhisperer ,

What can I do when there are more than 2 values, please?

id value

1 12

2 10

3 15

4 20

Thanks

Re: How to do the division of 2 values in the same field

ITWhisperer — Thu, 19 May 2022 10:34:30 GMT

mvindex uses index into the multivalue field, starting at 0, so if you wanted to calculate the percentage for id 3 and 4 you would do something like this

| stats list(value) as value | eval percent=100*mvindex(value,3)/mvindex(value,2)

Re: How to do the division of 2 values in the same field

Julia1231 — Thu, 19 May 2022 12:46:19 GMT

@ITWhisperer
When doing it, I have this error: Error in 'eval' command: Type checking failed. '*' only takes numbers.

And I have to define 2 variable to store each value and it works.... Do you know why?

| stats list(value) as value |eval n= mvindex(value,3) |eval m= mvindex(value,2) |eval percent=100*n/m

Re: How to do the division of 2 values in the same field

ITWhisperer — Thu, 19 May 2022 13:07:28 GMT

mvindex is probably returning a string so either do it the way you are or use the tonumber function

| stats list(value) as value |eval percent=100*tonumber(mvindex(value,3))/tonumber(mvindex(value,2))