Getting Data In

Divide a Result By Two

henryt1
Path Finder

The following search I'm running is giving me duplicate results for each event:

(host="zakta-test.inno-360.com") AND (demo-landscaping-test.inno-360.com) AND ("POST /search2sectionhandler.php" OR "POST /search2keephandler.php") | stats count by referer_domain

For instance if there were five events I'm interested in within the past hour it will return 10. However if I try to use "dedup" it just gives me a count of 1 since they're all similar events.

How would I divide the results by 2 within Splunk? To make it a little obvious just doing 10/2=5.

1 Solution

sdaniels
Splunk Employee
Splunk Employee

Instead of deduping based on host (not sure if that's what you are doing) maybe you could create another field for the URI's and dedup by those? Or maybe it's referer_domain that would work. Anyways hard to tell without seeing your raw events.

If you want to manipulate your count just use the eval command but hopefully you can find a way to use dedup.

... | eval newCount = count/2

View solution in original post

cheganbm
Explorer

using the fieldformat operator should do what you need.

...|fieldformat count=count/2

sdaniels
Splunk Employee
Splunk Employee

Instead of deduping based on host (not sure if that's what you are doing) maybe you could create another field for the URI's and dedup by those? Or maybe it's referer_domain that would work. Anyways hard to tell without seeing your raw events.

If you want to manipulate your count just use the eval command but hopefully you can find a way to use dedup.

... | eval newCount = count/2

View solution in original post

henryt1
Path Finder

This is great, thank you!

0 Karma

sdaniels
Splunk Employee
Splunk Employee

You could do
... | fields - count or pipe it to table and specify the columns you want ... | table myCount referer_domain. I think both of those will get rid of count for you.

0 Karma

henryt1
Path Finder

Thank you! This worked but it created a new column. Would there be a way to hide the original column (since I'm creating a chart from this and only need the new column)? Or would it be possible to divide this without creating a new column?

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!