Calculate Average in same field

[nivethainspire_]

I like to take sum the "count" where  "Core Content" field's first 2  max values, Finally divide them by total count.

For Example,

Core Content	Count
4268	2223
4267	1794
4266	305
4265	90
4264	19
4263	63
4262	133
4261	34
4260	26
	4768

In this table, I want the below calculation to be implemented using Eval.

(2223+1794) / 4768, where 2223 - 1st max value of core content, 1794 - 2nd max value of core content , 4768 - total count.

How to calculate this using eval.

[ITWhisperer]

your_search
| stats count AS Count BY "Core Content"
| eventstats sum(Count) AS total 
| eval Count=Count/total
| sort - Count 
| head 2 

[gcusello · Accepted solution]

Hi @nivethainspire_,

let me understand: do you want to display values and percentage of the first two values?

if yes, try something like this:

your_search
| stats count AS Count BY "Core Content"
| sort -Count 
| head 2 
| eventstats sum(Count) AS total 
| eval perc=round(Count/total*100,2)

Ciao.

Giuseppe

[gcusello]

Hi @nivethainspire_,

good for you!

Ciao and happy splunking.

Giuseppe

P.S. Karma Points are appreciated by all the contributors 😉

[nivethainspire_]

Thanks!. It works. Same way, I have to leave the first 2 max values and do the same for others. What should I do.

[gcusello]

if instead you want two values but the percentage respect all the values, you could use the top command:

your_search
| top 2 "Core Content"

Ciao.

 Giuseppe

[nivethainspire_]

I want to leave the top 2 and sum up others