Splunk Search

Assigning a row value for arthimetic calculation

Gowtham0809
New Member

I have a table output like
Date Title Product Count
10 November 2019 PA Number of A 371

10 November 2019 PA Number of B 129

10 November 2019 PA Number of C 195

10 November 2019 PA Number of D 110

10 November 2019 PA Total 455

10 November 2019 PA Number of E 1

10 November 2019 PA Number of F 0

10 November 2019 PA Number of G 0

10 November 2019 PA Number of H 0

10 November 2019 PA) Number of I 129

Here i have to perform the ratio calculation part with respect to total value, for remaining field values in count field. I do not want to print the calculation as | eval ratio=(Count/455)*100. I want to pass this value of total as some static field, as my total values keeps changing dynamically.

Is there a possible was

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This may help.

index=foo | eval Total=0, Sum=0 
| eval Total=if(Product="Total", Total+Count, Total), Sum=If(Product!="Total", Sum+Count, Sum)
| eval ratio=(Sum*100)/Total
---
If this reply helps you, Karma would be appreciated.
0 Karma

Gowtham0809
New Member

Hello Richgalloway

Thanks for your input, using this i am able to get Total column as 0 for all the rows and value 455 only for Total rows, and sum column as same values as of count except Total row as 0.

if I get the value or total 455 as a value for a new field for all the rows, then I cam perform the ratio part easily. Is is possible?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please disregard this answer as it won't work. I don't know what I was thinking when I wrote it. Sorry.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gowtham0809
New Member

if there any way to get solution on my condition

0 Karma
Got questions? Get answers!

Join the Splunk Community Slack to learn, troubleshoot, and make connections with fellow Splunk practitioners in real time!

Meet up IRL or virtually!

Join Splunk User Groups to connect and learn in-person by region or remotely by topic or industry.

Get Updates on the Splunk Community!

How much can you really learn in 3 minutes?

Observability can certainly be hard to understand – there's a lot of jargon and buzzwords and it seems to ...

Event Series: The Agentic SOC: Trust Before Autonomy

AI is fundamentally changing security operations, but true progress requires more than just automation—it ...

Free Professional Services for .conf26 Attendees

This year at .conf26, we are doing something a little different. We are bringing the best minds from ...