https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140801#M38954 <P>Can you provide sample data and sample results? Not sure what exactly you are looking for.</P> <P>In terms of your dc(group1) / dc(group2), it doesn't work that way, because group1 and group2 are values of the field "action". Distinct count of action [dc(action)], would return only 1 for group1, 1 for group2, and 1 for any other action value you have in the action field.</P> <P>Are you trying to count the number of results that are action=group1 and the results that are action=group2? For this you can just pipe into "stats count by action", or simply add count after your "dc(id)" to also get the count by action.</P> <P>Hope this helps</P> Mon, 01 Dec 2014 14:58:46 GMT aholzer 2014-12-01T14:58:46Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140800#M38953 <P>Hi,</P> <P>I'm new to splunk and not able to figure out the solution to the problem below.<BR /> Query: |eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| stats dc(id) by action</P> <P>From the above query, I get the count for values aggregated under group1 and group2. I would also want a field which calculates value for dc("group1") divided upon by dc("group2"). </P> <P>Please let me know how to get it.</P> Mon, 01 Dec 2014 12:22:30 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140800#M38953 fayazvf 2014-12-01T12:22:30Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140801#M38954 <P>Can you provide sample data and sample results? Not sure what exactly you are looking for.</P> <P>In terms of your dc(group1) / dc(group2), it doesn't work that way, because group1 and group2 are values of the field "action". Distinct count of action [dc(action)], would return only 1 for group1, 1 for group2, and 1 for any other action value you have in the action field.</P> <P>Are you trying to count the number of results that are action=group1 and the results that are action=group2? For this you can just pipe into "stats count by action", or simply add count after your "dc(id)" to also get the count by action.</P> <P>Hope this helps</P> Mon, 01 Dec 2014 14:58:46 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140801#M38954 aholzer 2014-12-01T14:58:46Z https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140802#M38955 <P>hi,<BR /> I think that this will have to help you. <BR /> You should initially count all the values of Group1 and Group2, then to make a division.<BR /> <STRONG>grou1:</STRONG><CODE>|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1</CODE><BR /> <STRONG>group2:</STRONG><CODE>|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"| stats c by action as GROUP2</CODE><BR /> <STRONG>division</STRONG><CODE>eval Division=GROUP1/GROUP2]</CODE></P> <P><STRONG>General solution:</STRONG><CODE>|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup1"| stats c by action as GROUP1|appencolds [search ...|eval action=if(field1="value1", "group1", if(field2="value2", "group2", action))| where action="goup2"|stats c by action as GROUP2]| eval Division=GROUP1/GROUP2</CODE></P> Wed, 17 Dec 2014 09:44:06 GMT https://community.splunk.com/t5/Splunk-Search/How-to-divide-2-distinct-counts-of-aggregated-values-using-eval/m-p/140802#M38955 Tanefo 2014-12-17T09:44:06Z