Splunk Search

Calculate Average in same field

nivethainspire_
Explorer

I like to take sum the "count" where  "Core Content" field's first 2  max values, Finally divide them by total count.

For Example,

Core ContentCount
42682223
42671794
4266305
426590
426419
426363
4262133
426134
4260

26

 

4768

 

In this table, I want the below calculation to be implemented using Eval.

(2223+1794) / 4768, where 2223 - 1st max value of core content, 1794 - 2nd max value of core content , 4768 - total count.

How to calculate this using eval.

 

Labels (1)
0 Karma
1 Solution

gcusello
SplunkTrust
SplunkTrust

Hi @nivethainspire_,

let me understand: do you want to display values and percentage of the first two values?

if yes, try something like this:

your_search
| stats count AS Count BY "Core Content"
| sort -Count 
| head 2 
| eventstats sum(Count) AS total 
| eval perc=round(Count/total*100,2)

Ciao.

Giuseppe

View solution in original post

ITWhisperer
SplunkTrust
SplunkTrust
your_search
| stats count AS Count BY "Core Content"
| eventstats sum(Count) AS total 
| eval Count=Count/total
| sort - Count 
| head 2 
0 Karma

gcusello
SplunkTrust
SplunkTrust

Hi @nivethainspire_,

let me understand: do you want to display values and percentage of the first two values?

if yes, try something like this:

your_search
| stats count AS Count BY "Core Content"
| sort -Count 
| head 2 
| eventstats sum(Count) AS total 
| eval perc=round(Count/total*100,2)

Ciao.

Giuseppe

gcusello
SplunkTrust
SplunkTrust

Hi @nivethainspire_,

good for you!

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated by all the contributors 😉

0 Karma

nivethainspire_
Explorer

Thanks!. It works. Same way, I have to leave the first 2 max values and do the same for others. What should I do.

0 Karma

gcusello
SplunkTrust
SplunkTrust

if instead you want two values but the percentage respect all the values, you could use the top command:

your_search
| top 2 "Core Content"

Ciao.

 Giuseppe

0 Karma

nivethainspire_
Explorer

I want to leave the top 2 and sum up others

0 Karma
Get Updates on the Splunk Community!

Take Your Breath Away with Splunk Risk-Based Alerting (RBA)

WATCH NOW!The Splunk Guide to Risk-Based Alerting is here to empower your SOC like never before. Join Haylee ...

Industry Solutions for Supply Chain and OT, Amazon Use Cases, Plus More New Articles ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Enterprise Security Content Update (ESCU) | New Releases

In November, the Splunk Threat Research Team had one release of new security content via the Enterprise ...