topic Re: Calculating a ratio of distinct counts in a timechart in Splunk Search
https://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139512#M38376
<P>Something like this?</P>
<PRE><CODE>index=blaw sourcetype=blaw type=X OR type=Y | bucket span=SpanOfYourChoice _time | stats count by _time, type, userId | timechart span=SpanOfYourChoice dc(eval(type="X")) as Xcount dc(eval(type="Y")) as Ycount | eval XYratio=Xcount/Ycount | table _time, XYratio
</CODE></PRE>Thu, 25 Sep 2014 03:11:42 GMTsomesoni22014-09-25T03:11:42ZCalculating a ratio of distinct counts in a timechart
https://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139511#M38375
<P>I have series of events with user ids in them. I would like to calculate the ratio of distinct user ids for events that have a type of X vs. the distinct user ids for events that have a type of Y, in a timechart over time grouped by a different field.</P>
<P>What would be the right way to do this?</P>Thu, 25 Sep 2014 01:57:53 GMThttps://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139511#M38375emmby2014-09-25T01:57:53ZRe: Calculating a ratio of distinct counts in a timechart
https://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139512#M38376
<P>Something like this?</P>
<PRE><CODE>index=blaw sourcetype=blaw type=X OR type=Y | bucket span=SpanOfYourChoice _time | stats count by _time, type, userId | timechart span=SpanOfYourChoice dc(eval(type="X")) as Xcount dc(eval(type="Y")) as Ycount | eval XYratio=Xcount/Ycount | table _time, XYratio
</CODE></PRE>Thu, 25 Sep 2014 03:11:42 GMThttps://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139512#M38376somesoni22014-09-25T03:11:42ZRe: Calculating a ratio of distinct counts in a timechart
https://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139513#M38377
<P>Would something like this give you results close to what you're after?</P>
<P><CODE>index=main "blabla" | eval typeX=IF(userType="X",1,0) | eval typeY=IF(userType="Y",1,0) | timechart sum(typeX), sum(typeY) by state</CODE></P>Thu, 25 Sep 2014 03:15:57 GMThttps://community.splunk.com/t5/Splunk-Search/Calculating-a-ratio-of-distinct-counts-in-a-timechart/m-p/139513#M38377musskopf2014-09-25T03:15:57Z