topic Perform calculation based on 2 stats count result in Splunk Search

Perform calculation based on 2 stats count result

krusovice — Tue, 27 Mar 2018 06:43:45 GMT

Hello,

I've a requirement to perform the following calculation in percentage.

First query is as below and single value result is 50

    index=* 
    | rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
    | stats count(client) as Count

Then I've another query and single value result is 10:

index=* 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(productid)

I need to perform the calculation based on the result of above 2 queries. The calculation formula should be 10/50 = 20%. How can I achieve it to come out with 20% as the output of the calculation in Splunk?

Thanks.

Re: Perform calculation based on 2 stats count result

493669 — Tue, 27 Mar 2018 06:52:13 GMT

try this:

 index=*|rex field=_raw "Product ABC.*client\=(?<client>[\w+]+)" 
| rex field=_raw "Broken Product.*productid\=(?<productid>[\w+]+)" 
| stats count(client) as clientcount , count(productid) as productcount
|eval percentage=((productcount/clientcount)*100)."%"

Re: Perform calculation based on 2 stats count result

krusovice — Tue, 27 Mar 2018 07:02:31 GMT

Hi @493669,

It's work! Thank you. Can you update as answer so that I can accept it officially?