topic I need a single value after dividing 2 results which we obtain as a result of stats dc. As of now, I see 3 values. in Splunk Search

I need a single value after dividing 2 results which we obtain as a result of stats dc. As of now, I see 3 values.

prateedshetty — Fri, 27 Jan 2017 10:57:38 GMT

The query I use is-

sourcetype=iis URL_root=abc "https://www.abc.com"|stats dc(SessionId) as TotalVisits, dc(userid) as TotalUsers|eval AvgVisit=TotalVisits/TotalUsers

So the final result I see has 1 row but with 3 values-one each for TotalVisits, Totalusers and AvgVisit. But in the dashboard all I need is the AvgVisit value. This is to calculate the average visit per visitor value. Using the single Value panel in the dashboard displays the first value i.e TotalVisits. Please help!

Re: I need a single value after dividing 2 results which we obtain as a result of stats dc. As of now, I see 3 values.

somesoni2 — Fri, 27 Jan 2017 15:59:18 GMT

You just need to add a table command at the end of your search to list the fields that you want to display (and in which order).

sourcetype=iis URL_root=abc "https://www.abc.com"|stats dc(SessionId) as TotalVisits, dc(userid) as TotalUsers|eval AvgVisit=TotalVisits/TotalUsers | table AvgVisit

Re: I need a single value after dividing 2 results which we obtain as a result of stats dc. As of now, I see 3 values.

prateedshetty — Wed, 08 Feb 2017 13:16:21 GMT

Thanks! It worked as I wanted it to.. 🙂