Join the Conversation
- Find Answers
- :
- Using Splunk
- :
- Other Using Splunk
- :
- Reporting
- :
- Re: Data Model: If I have a 2 columns in a pivot w...
- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark Topic
- Subscribe to Topic
- Mute Topic
- Printer Friendly Page
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Data Model: If I have a 2 columns in a pivot with numeric values, is it possible to create a 3rd column with a ratio of those values?
Hi
In the pivot, I have two columns with numeric values. I would like to create third column with ratio of those two compute columns.
Is it possible? I do not want to add to the search in the data model because then I cannot use other attributes.
e.g
Column1/column2=column3
Data Column1 Column2 Column3
01-01-2015 100 200 0.5
02-02- 2015 200 100 2
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
Add a calculated field using eval expression to your data model.
App-> pivot->choose datamodel-> Edit->disable acceleration(if enabled) -> Edit --> Add attribute --> Choose Eval ( enter below eval condition & Preview, submit)
eval Column3=Cloumn2/Column1
And also you can find more information for adding calculated fields here.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
This will not work because Column 1 and Column2 are created in Pivot as Column Volume (they do not exist in the objects)
Basically they are aggregated values created in Pivot editor
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
OK try to open the search and apply the eval on the search and you can save it as report/Dashboard.
AFAIK calculation on the pivot editor not possible, never tried let me check it out.
- Mark as New
- Bookmark Message
- Subscribe to Message
- Mute Message
- Subscribe to RSS Feed
- Permalink
- Report Inappropriate Content
in search I can not add this because calculated fields do not exist. They are computed in the Pivot
Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!
Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.
May 2026 Splunk Expert Sessions: Security & Observability
Network to App: Observability Unlocked [May & June Series]
SPL2 Deep Dives, AppDynamics Integrations, SAML Made Simple and Much More on Splunk ...
