Is there a way to run multiple stats commands on two separate Columns? My data set looks likes this:
Col 1 | Col 2 |
Foo | "" |
"" | Bar |
I want to count both columns and the sum both columns and the divide column one by the sum of Col 1 + Col 2. Is this possible, I'm pretty new to Splunk and only have had training for Splunk Fundamentals One.
Anything helps, thanks!
Something along these lines?
| eventstats sum(col1) as sum_col1 sum(col2) as sum_col2 count(col1) as count_col1 count(col2) as count_col2
| eval sum_both=sum_col1+sum_col2
| eval col1=col1/sum_both