Splunk Search

Assigning a row value for arthimetic calculation

Gowtham0809
New Member

I have a table output like
Date Title Product Count
10 November 2019 PA Number of A 371

10 November 2019 PA Number of B 129

10 November 2019 PA Number of C 195

10 November 2019 PA Number of D 110

10 November 2019 PA Total 455

10 November 2019 PA Number of E 1

10 November 2019 PA Number of F 0

10 November 2019 PA Number of G 0

10 November 2019 PA Number of H 0

10 November 2019 PA) Number of I 129

Here i have to perform the ratio calculation part with respect to total value, for remaining field values in count field. I do not want to print the calculation as | eval ratio=(Count/455)*100. I want to pass this value of total as some static field, as my total values keeps changing dynamically.

Is there a possible was

Tags (2)
0 Karma

richgalloway
SplunkTrust
SplunkTrust

This may help.

index=foo | eval Total=0, Sum=0 
| eval Total=if(Product="Total", Total+Count, Total), Sum=If(Product!="Total", Sum+Count, Sum)
| eval ratio=(Sum*100)/Total
---
If this reply helps you, Karma would be appreciated.
0 Karma

Gowtham0809
New Member

Hello Richgalloway

Thanks for your input, using this i am able to get Total column as 0 for all the rows and value 455 only for Total rows, and sum column as same values as of count except Total row as 0.

if I get the value or total 455 as a value for a new field for all the rows, then I cam perform the ratio part easily. Is is possible?

Thanks

0 Karma

richgalloway
SplunkTrust
SplunkTrust

Please disregard this answer as it won't work. I don't know what I was thinking when I wrote it. Sorry.

---
If this reply helps you, Karma would be appreciated.
0 Karma

Gowtham0809
New Member

if there any way to get solution on my condition

0 Karma
Get Updates on the Splunk Community!

Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...