https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261328#M78430 <P>I have cache hit as well as cache miss reports, How do i get the ratio of cache hit i.e, cache hit / (cache hit + cache miss)?</P> Mon, 23 May 2016 18:07:56 GMT spandana9 2016-05-23T18:07:56Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261328#M78430 <P>I have cache hit as well as cache miss reports, How do i get the ratio of cache hit i.e, cache hit / (cache hit + cache miss)?</P> Mon, 23 May 2016 18:07:56 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261328#M78430 spandana9 2016-05-23T18:07:56Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261329#M78431 <P>... | eval ratio=cacheHit/(cacheHit+cacheMiss) | ...</P> <P>if cacheHit and cacheMiss arent fields... and specifically arent integers, then you'll have to create your own with some eval magic like this example which creates counters based on finding patterns in the raw event data:</P> <PRE><CODE>... | eval cacheHits=if(match(_raw,"Pattern that is found in cache hit events"),cacheHits+1,cacheHits) | eval cacheMisses=if(match(_raw,"Pattern that is found in cache miss events"),cacheMisses+1,cacheMisses) | eval cacheHitRatio=cacheHits/(cacheHits+cacheMisses) | table cacheHits, cacheMisses, cacheHitRatio </CODE></PRE> Mon, 23 May 2016 20:19:29 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261329#M78431 jkat54 2016-05-23T20:19:29Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261330#M78432 <P>Thank you.</P> Mon, 23 May 2016 20:20:51 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261330#M78432 spandana9 2016-05-23T20:20:51Z https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261331#M78433 <P>If this worked as an answer, please use the "mark as answer" link below the answer. The upvote is certainly appreciated as well. Glad to help!</P> Mon, 23 May 2016 20:24:22 GMT https://community.splunk.com/t5/Splunk-Search/How-do-I-get-Cache-Hit-ratio/m-p/261331#M78433 jkat54 2016-05-23T20:24:22Z