Splunk Search

Calculate Ratio of Two Counter Streams

sks
New Member

I've two counter streams, I would like to display that as a percentage as

B/(B+C)  in the chart but it always gives me an error. 

B = data('prod.metrics.biz.l2_cache_miss', rollup='rate', extrapolation='zero').publish(label='B')
C = data('prod.metrics.biz.l2_cache_hit', rollup='rate', extrapolation='zero').publish(label='C')


How can I create a new metrics out of these two to find either cache hit or miss percentage? 

Labels (2)
0 Karma

KendallW
Contributor

Hi @sks if you want just the percentage of misses and the percentage of hits, you can do this with eval:

| eval Bperc=('B'/(B+C))*100
| eval Cperc=('C'/(B+C))*100

If you want to show this in a chart (e.g. pie chart) you don't need to calculate the percentage as Splunk will do this for you, but you will need to get the values of B and C in the same column using transpose. Example:

KendallW_0-1711418990776.png

 

0 Karma

sks
New Member

Hi @KendallW  

Thanks for the reply, but that does not work as I'm plotting this in the line chart.   The data is coming to SignalFx from the StatsD agent.   

Screenshot 2024-03-26 at 11.24.54 AM.png

0 Karma
Get Updates on the Splunk Community!

Data Management Digest – November 2025

  Welcome to the inaugural edition of Data Management Digest! As your trusted partner in data innovation, the ...

Splunk Mobile: Your Brand-New Home Screen

Meet Your New Mobile Hub  Hello Splunk Community!  Staying connected to your data—no matter where you are—is ...

Introducing Value Insights (Beta): Understand the Business Impact your organization ...

Real progress on your strategic priorities starts with knowing the business outcomes your teams are delivering ...