https://community.splunk.com/t5/Splunk-Search/Weight-host-using-lookup-table/m-p/94662#M24446 <P>I'm trying to get a weighted ratio of errors per server. I have a lookup table like this:</P> <P>host,percent<BR /> server1,25<BR /> server2,25<BR /> server3,50</P> <P>Normally I'd do something like <CODE>sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | chart count by host</CODE>, which gives me a count of errors by server, but I want a weighted count based on that percent.</P> <P>How would I use the lookup table to multiply the errors on a per server basis?</P> Mon, 15 Apr 2013 18:09:03 GMT jevenson 2013-04-15T18:09:03Z https://community.splunk.com/t5/Splunk-Search/Weight-host-using-lookup-table/m-p/94662#M24446 <P>I'm trying to get a weighted ratio of errors per server. I have a lookup table like this:</P> <P>host,percent<BR /> server1,25<BR /> server2,25<BR /> server3,50</P> <P>Normally I'd do something like <CODE>sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | chart count by host</CODE>, which gives me a count of errors by server, but I want a weighted count based on that percent.</P> <P>How would I use the lookup table to multiply the errors on a per server basis?</P> Mon, 15 Apr 2013 18:09:03 GMT https://community.splunk.com/t5/Splunk-Search/Weight-host-using-lookup-table/m-p/94662#M24446 jevenson 2013-04-15T18:09:03Z https://community.splunk.com/t5/Splunk-Search/Weight-host-using-lookup-table/m-p/94663#M24447 <P>Hi! <span class="lia-unicode-emoji" title=":slightly_smiling_face:">🙂</span></P> <P>So, if what you want to do it multiply the count by the defined percent value for each of these hosts, you could do something like:</P> <PRE><CODE>sourcetype=iis sc_status=500 [| inputlookup ratio | fields host] | lookup yourlookuptable host OUTPUT percent | chart count by host | eval weightedcount=count*percent/100 </CODE></PRE> Mon, 15 Apr 2013 18:25:58 GMT https://community.splunk.com/t5/Splunk-Search/Weight-host-using-lookup-table/m-p/94663#M24447 Ayn 2013-04-15T18:25:58Z