topic Re: Calculate Ratio of Two Counter Streams in Splunk Search

Calculate Ratio of Two Counter Streams

sks — Mon, 11 Mar 2024 04:47:36 GMT

I've two counter streams, I would like to display that as a percentage as

B/(B+C) in the chart but it always gives me an error.

B = data('prod.metrics.biz.l2_cache_miss', rollup='rate', extrapolation='zero').publish(label='B')
C = data('prod.metrics.biz.l2_cache_hit', rollup='rate', extrapolation='zero').publish(label='C')

How can I create a new metrics out of these two to find either cache hit or miss percentage?

Re: Calculate Ratio of Two Counter Streams

KendallW — Tue, 26 Mar 2024 02:10:24 GMT

Hi @sks if you want just the percentage of misses and the percentage of hits, you can do this with eval:

| eval Bperc=('B'/(B+C))*100 | eval Cperc=('C'/(B+C))*100

If you want to show this in a chart (e.g. pie chart) you don't need to calculate the percentage as Splunk will do this for you, but you will need to get the values of B and C in the same column using transpose. Example:

Re: Calculate Ratio of Two Counter Streams

sks — Tue, 26 Mar 2024 05:57:28 GMT

Hi @KendallW

Thanks for the reply, but that does not work as I'm plotting this in the line chart. The data is coming to SignalFx from the StatsD agent.