Solved: Re: Calculated the percent difference between two ... - Page 2

Branden · ‎10-01-2010

This is a tricky one (or is it?)...

I have indexed Splunk data that looks like this (using multikv):

device_name     host    list(Select)    list(Disk)      difference
vpath0        xyz     19072176        fscsi2/hdisk28  13409 
                        19058767        fscsi3/hdisk56

I'd like to be alerted if the difference between the two "list(Select)" fields is greater than 5%. I know how to do the math on paper, but I can't figure out how to apply it to Splunk. Essentially, I need to divide the "difference" by value of the higher "list(Select)", then multiply by 100.

I've been dabbling with this, but now I'm wondering if it's even possible.

Thanks!

ftk · ‎10-01-2010

You can use the eval command:

your search |  eval percent_difference=(difference/max(list(Select))*100)

Then set up a custom alert condition that hits when percent_difference > 5.

If this doesn't work try renaming your list(Select) to a more friendly name (without parenthesis).

[Edit:] Ok, playing around with your query and my data I noticed that the list(Select) didn't return a numerical value list for me, which caused the calculation of percent_difference to fail. Try adding a tonumber() (added in 4.1.4 or 4.1.5, so you need a recent version for this to work) into your query as such:

sourcetype="datapath-device" earliest=-2h| rex "^DEV#:\s+(?<dev_no>\d+)\s+DEVICE NAME:\s+(?<device_name>\S+)\s+TYPE:\s+(?<type>\d+)\s+POLICY:\s+(?<policy>\S+)" | rex "SERIAL:\s+(?<serial>\S+)" | multikv | stats list(Select) as listSelect, list(Disk), range(Select) as difference by device_name, host | eval percent_difference=((difference/max(tonumber(listSelect)))*100)

If that doesn't work, use eventstats instead of regular stats as such:

sourcetype="datapath-device" earliest=-2h| rex "^DEV#:\s+(?<dev_no>\d+)\s+DEVICE NAME:\s+(?<device_name>\S+)\s+TYPE:\s+(?<type>\d+)\s+POLICY:\s+(?<policy>\S+)" | rex "SERIAL:\s+(?<serial>\S+)" | multikv | eventstats list(Select) as listSelect, list(Disk), range(Select) as difference by device_name, host | eval percent_difference=((difference/max(tonumber(listSelect)))*100)

[Edit2] What about this:

sourcetype="datapath-device" earliest=-2h| rex "^DEV#:\s+(?<dev_no>\d+)\s+DEVICE NAME:\s+(?<device_name>\S+)\s+TYPE:\s+(?<type>\d+)\s+POLICY:\s+(?<policy>\S+)" | rex "SERIAL:\s+(?<serial>\S+)" | multikv | stats list(Select) as listSelect, list(Disk), range(Select) as difference by device_name, host | eventstats max(listSelect) as maxSelect | eval percent_difference=((difference/maxSelect)*100)

[EDIT 3:] how about streamstats?

sourcetype="datapath-device" earliest=-2h| rex "^DEV#:\s+(?<dev_no>\d+)\s+DEVICE NAME:\s+(?<device_name>\S+)\s+TYPE:\s+(?<type>\d+)\s+POLICY:\s+(?<policy>\S+)" | rex "SERIAL:\s+(?<serial>\S+)" | multikv | stats list(Select) as listSelect, list(Disk), range(Select) as difference by device_name, host | streamstats max(listSelect) as maxSelect window=1 | eval percent_difference=((difference/maxSelect)*100)

View solution in original post

Branden · ‎10-01-2010

I also modified the eval command a bit to look like this:

eval percent_difference=((difference/max(listSelect))*100)

Still not sure why it doesn't appear as a field "percent_difference" though...

Branden · ‎10-01-2010

Thank you very much for your reply.
I had to change the list(Select) field name like you said, no big deal.
I ran the query with the eval command, but I don't see the result anywhere. Shouldn't percent_difference show up as a field?

Calculated the percent difference between two values

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Splunk Auto Ingestion Parallel Pipeline Scaling

Splunk Cloud Application Management in Terraform

What's New in Splunk Enterprise Security (ES) 8.6

Join the Conversation