All Apps and Add-ons

How to calculate 2 different search results from one source

tpaulsen
Contributor

Hello,

we want to calculate some Requesttimes vs. Requestnumbers.

What we do is

source=ourdata.log | timechart span=1h sum(duration) as impact count(ws-method) by domain

Now we want to search in the same log for

source=ourdata.log | stats (count) ws-method="thespecialmessage"

With the results from the second search, we want to divide the results from the first query. how can we do that?
This seems to be a multidimensional search...

0 Karma

rturk
Builder

Hi tpaulson,

Have you thought about using subsearches?

Check the doco:
http://docs.splunk.com/Documentation/Splunk/5.0.4/Tutorial/Useasubsearch

0 Karma

yannK
Splunk Employee
Splunk Employee

tpaulson,

I do not understand your second search.

do you mean : source=ourdata.log ws-method="thespecialmessage" | stats count
or
source=ourdata.log ws-method="thespecialmessage" | stats count(eval(ws-method=="thespecialmessage") ?

As Turk mentioned, the subsearch is your friend here.

0 Karma
Get Updates on the Splunk Community!

What's new in Splunk Cloud Platform 9.1.2312?

Hi Splunky people! We are excited to share the newest updates in Splunk Cloud Platform 9.1.2312! Analysts can ...

What’s New in Splunk Security Essentials 3.8.0?

Splunk Security Essentials (SSE) is an app that can amplify the power of your existing Splunk Cloud Platform, ...

Let’s Get You Certified – Vegas-Style at .conf24

Are you ready to level up your Splunk game? Then, let’s get you certified live at .conf24 – our annual user ...