Splunk Search

Bucket and eval result to percentage calculation

Seawheels51
Explorer

Greetings Community Experts

I have a group of devices that each should report state to a portal every 10 seconds. If a device fails to report for 6 periods - one minute, I am categorizing the device as disconnected. The time period is a workday of 6:30 AM - 6:30 PM (12 hours / 720 minutes). I am trying to use the search results to generate a percentage of connected devices. The calculation fails in the last step. Requesting your assistance to develop a working search. Here is the search I am using. Thanks in advance!

index=test earliest=-2d@d+6h+30m latest=-1d@d-5h-30m
| bucket span=1m _time
| stats count by _time, SerialNumber
| eval state=if(count>=1, "Con", "Dcon")
| stats count by SerialNumber, state | eval status=case(count=720, "Connected", count<720, "Disconnected")
| stats count by status
| eval Percent=round((Connected-Disconnected)/Connected*100, 2)."%"

Labels (3)
0 Karma
1 Solution

Seawheels51
Explorer

I was able to obtain the results I desired with this search

index=test earliest=-1d@d+6h+30m latest=-0d@d-5h-30m | stats count by SerialNumber | stats count(eval(count>=4314)) as Con count(eval(count<4314)) as Dcon | eval Percent=round((Con)/Dcon*10, 2)."%" | fields Percent

View solution in original post

0 Karma

Seawheels51
Explorer

I was able to obtain the results I desired with this search

index=test earliest=-1d@d+6h+30m latest=-0d@d-5h-30m | stats count by SerialNumber | stats count(eval(count>=4314)) as Con count(eval(count<4314)) as Dcon | eval Percent=round((Con)/Dcon*10, 2)."%" | fields Percent

0 Karma
Get Updates on the Splunk Community!

Splunk Forwarders and Forced Time Based Load Balancing

Splunk customers use universal forwarders to collect and send data to Splunk. A universal forwarder can send ...

NEW! Log Views in Splunk Observability Dashboards Gives Context From a Single Page

Today, Splunk Observability releases log views, a new feature for users to add their logs data from Splunk Log ...

Last Chance to Submit Your Paper For BSides Splunk - Deadline is August 12th!

Hello everyone! Don't wait to submit - The deadline is August 12th! We have truly missed the community so ...