Splunk Enterprise

Help on timechart events after ratio calculation

jip31
Motivator

hello

I use the search below in order to timechart events on the field "BPE - Evolution du ratio de perte de paquets"

It works fine but is there way to do the same thing easily please?

 

 

`index` sourcetype="netproc_tcp" ezc="BPE" 
| fields netproc_tcp_retrans_bytes site 
| bin _time span=30m  
| stats sum(netproc_tcp_retrans_bytes) as "PaquetsPerdusBPE" by _time site 
| search site="$site$" 
| append 
    [| search `index` sourcetype="netproc_tcp" ezc="BPE" 
    | fields netproc_tcp_total_bytes site 
    | bin _time span=30m 
| stats sum(netproc_tcp_total_bytes) as "PaquetsGlobauxBPE" by _time site 
        ] 
| search site="$site$" 
| stats last("PaquetsPerdusBPE") as "BPE - Paquets perdus (bytes)", last("PaquetsGlobauxBPE") as "BPE - Nombre total de paquets (bytes)" by _time site 
| eval "BPE - Evolution du ratio de perte de paquets" = ('BPE - Paquets perdus (bytes)' / 'BPE - Nombre total de paquets (bytes)') * 100 
| fields - "BPE - Paquets VMware perdus (bytes)" "BPE - Nombre total de paquets (bytes)" site

 

Labels (1)
Tags (1)
0 Karma
1 Solution

ITWhisperer
SplunkTrust
SplunkTrust

Try this

`index` sourcetype="netproc_tcp" ezc="BPE" 
| fields netproc_tcp_retrans_bytes netproc_tcp_total_bytes site 
| bin _time span=30m  
| stats sum(netproc_tcp_retrans_bytes) as "PaquetsPerdusBPE" sum(netproc_tcp_total_bytes) as "PaquetsGlobauxBPE" by _time site 
| search site="$site$" 
| eval "BPE - Evolution du ratio de perte de paquets" = (PaquetsPerdusBPE / PaquetsGlobauxBPE) * 100 
| fields - PaquetsPerdusBPE PaquetsGlobauxBPE site

View solution in original post

0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Not sure what the ask is here - what could be easier than using what you already have?

0 Karma

jip31
Motivator

I am just not sure that there is not a better way to do the same job, it's just the sense of my post

Tags (1)
0 Karma

ITWhisperer
SplunkTrust
SplunkTrust

Try this

`index` sourcetype="netproc_tcp" ezc="BPE" 
| fields netproc_tcp_retrans_bytes netproc_tcp_total_bytes site 
| bin _time span=30m  
| stats sum(netproc_tcp_retrans_bytes) as "PaquetsPerdusBPE" sum(netproc_tcp_total_bytes) as "PaquetsGlobauxBPE" by _time site 
| search site="$site$" 
| eval "BPE - Evolution du ratio de perte de paquets" = (PaquetsPerdusBPE / PaquetsGlobauxBPE) * 100 
| fields - PaquetsPerdusBPE PaquetsGlobauxBPE site
0 Karma
Get Updates on the Splunk Community!

Index This | I’m short for "configuration file.” What am I?

May 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with a Special ...

New Articles from Academic Learning Partners, Help Expand Lantern’s Use Case Library, ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Your Guide to SPL2 at .conf24!

So, you’re headed to .conf24? You’re in for a good time. Las Vegas weather is just *chef’s kiss* beautiful in ...