All Apps and Add-ons

How to calculate 2 different search results from one source

tpaulsen
Contributor

Hello,

we want to calculate some Requesttimes vs. Requestnumbers.

What we do is

source=ourdata.log | timechart span=1h sum(duration) as impact count(ws-method) by domain

Now we want to search in the same log for

source=ourdata.log | stats (count) ws-method="thespecialmessage"

With the results from the second search, we want to divide the results from the first query. how can we do that?
This seems to be a multidimensional search...

0 Karma

rturk
Builder

Hi tpaulson,

Have you thought about using subsearches?

Check the doco:
http://docs.splunk.com/Documentation/Splunk/5.0.4/Tutorial/Useasubsearch

0 Karma

yannK
Splunk Employee
Splunk Employee

tpaulson,

I do not understand your second search.

do you mean : source=ourdata.log ws-method="thespecialmessage" | stats count
or
source=ourdata.log ws-method="thespecialmessage" | stats count(eval(ws-method=="thespecialmessage") ?

As Turk mentioned, the subsearch is your friend here.

0 Karma
.conf21 CFS Extended through 5/20!

Don't miss your chance
to share your Splunk
wisdom in-person or
virtually at .conf21!

Call for Speakers has
been extended through
Thursday, 5/20!