Splunk Search

Assigning a row value for arthimetic calculation

Gowtham0809
New Member

I have a table output like
Date Title Product Count
10 November 2019 PA Number of A 371

10 November 2019 PA Number of B 129

10 November 2019 PA Number of C 195

10 November 2019 PA Number of D 110

10 November 2019 PA Total 455

10 November 2019 PA Number of E 1

10 November 2019 PA Number of F 0

10 November 2019 PA Number of G 0

10 November 2019 PA Number of H 0

10 November 2019 PA) Number of I 129

Here i have to perform the ratio calculation part with respect to total value, for remaining field values in count field. I do not want to print the calculation as | eval ratio=(Count/455)*100. I want to pass this value of total as some static field, as my total values keeps changing dynamically.

Is there a possible was

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This may help.

index=foo | eval Total=0, Sum=0 
| eval Total=if(Product="Total", Total+Count, Total), Sum=If(Product!="Total", Sum+Count, Sum)
| eval ratio=(Sum*100)/Total
---
If this reply helps you, Karma would be appreciated.
0 Karma

Gowtham0809
New Member

Hello Richgalloway

Thanks for your input, using this i am able to get Total column as 0 for all the rows and value 455 only for Total rows, and sum column as same values as of count except Total row as 0.

if I get the value or total 455 as a value for a new field for all the rows, then I cam perform the ratio part easily. Is is possible?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please disregard this answer as it won't work. I don't know what I was thinking when I wrote it. Sorry.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gowtham0809
New Member

if there any way to get solution on my condition

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...