Splunk Search

How can I derive a field based on the existing two fields?

newsplnkr
Explorer

Hello All,

I am new to Splunk, and in need of help for below events:

  1. [testName="MobileExp",experience="FetchOn"]
  2. [testName="MobileExp",experience="FetchOff"]
  3. [testName="ProductDesign",experience="A"]
  4. [testName="ProductDesign",experience="B"]
  5. [testName="ProductDesign",experience="C"]
  6. [testName="ProductDesign",experience="B"]
  7. [testName="ProductDesign",experience="B"]

Using above events, I wanted to derive a field which would have percentage for each "experience" of a "testName". For example, for testName="MobileExp", there are two experiences, each of them appearing exactly once. So, percentage split for the experiences relating to testName="MobileExp" is 50%.

Thank you in advance!

Tags (1)
0 Karma
1 Solution

newsplnkr
Explorer

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

View solution in original post

0 Karma

newsplnkr
Explorer

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

0 Karma

macadminrohit
Contributor

question: why you are deduping at the end ?

0 Karma

newsplnkr
Explorer

I did it to remove any duplicate records

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Accept the answer

0 Karma

renjith_nair
Legend

@newsplnkr ,

Try

"your base search "|eventstats count by testName,experience
|eventstats sum(count) as total by testName
|eval perc=round((count/total)*100,2)|fields - count,total
---
What goes around comes around. If it helps, hit it with Karma 🙂

newsplnkr
Explorer

Hi Renjith, unfortunately, the above query does not produce any results.

0 Karma

macadminrohit
Contributor

Try this search, replace the base search as per your data :

| makeresults 
| eval Data="testName:MobileExp,experience:FetchOn;testName:MobileExp,experience:FetchOff;testName:ProductDesign,experience:A;testName:ProductDesign,experience:C;testName:ProductDesign,experience:B;testName:ProductDesign,experience:B" 
| makemv delim=";" Data 
| mvexpand Data 
| eval Split1=mvindex(split(Data,","),0) 
| eval Split2=mvindex(split(Data,","),1) | eval testName=mvindex(split(Split1,":"),1) | eval experience=mvindex(split(Split2,":"),1) | table _time testName experience | eventstats count as test_count by testName experience | eventstats sum(test_count) as Total by testName | eval perc=(test_count/Total*100)
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud’s AI Assistant in Action Series: Analyzing and ...

This is the second post in our Splunk Observability Cloud’s AI Assistant in Action series, in which we look at ...

Elevate Your Organization with Splunk’s Next Platform Evolution

 Thursday, July 10, 2025  |  11AM PDT / 2PM EDT Whether you're managing complex deployments or looking to ...

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...