Splunk Enterprise Security

Ratios based on field values in Stats

JeffBothel
Explorer

I am looking to get a ratio in something akin to the following method but this is throwing errors from Splunk ES:

eval(count(eval(if(action!="success",1,null())))/count(eval(if(action=="success",1,null()))))

Anyone have any suggestions as to what might be the problem?

0 Karma

mayurr98
Super Champion

Use this query as a reference to calculate ratio:

basesearch | stats count(eval(if(action!="success",1,null))) as count1 count(eval(if(action="success",1,null))) as count2 | eval ratio=round(count1/count2,2) | fields ratio

Let me know if it works!

Get Updates on the Splunk Community!

Observability Unlocked: Kubernetes Monitoring with Splunk Observability Cloud

 Ready to master Kubernetes and cloud monitoring like the pros? Join Splunk’s Growth Engineering team for an ...

Update Your SOAR Apps for Python 3.13: What Community Developers Need to Know

To Community SOAR App Developers - we're reaching out with an important update regarding Python 3.9's ...

October Community Champions: A Shoutout to Our Contributors!

As October comes to a close, we want to take a moment to celebrate the people who make the Splunk Community ...