Splunk Search

## Calculate a value based on multiple events

Explorer

My events have the following structure:
`id=[id] key=[key] value=[value]`

For example:
`id=1 key=mycounter value=4`
`id=1 key=mytime value=40`
`id=2 key=mycounter value=5`
`id=2 key=mytime value=70`
`id=3 key=mycounter value=8`
`id=3 key=mytime value=90`

I would like to calculate `mycounter/mytime` for each `id`.

I created a table (`(key=mycounter OR key=mytime) | dedup id, key | table id, key, value`) and tried to apply `mvcombine` and `makemv`, but I was not able to get it working. Is this the right way to go or is there a better way in Splunk?

Tags (2)
1 Solution
SplunkTrust

Try this:

``````key=mycounter OR key=mytime | eval value_{key} = value | stats first(value_*) as * by id | eval result = mycounter / mytime
``````

The first `eval` creates two fields, `value_mycounter` and `value_mytime`. The `stats` merges the two events into one for each `id`. The final `eval` does the actual maths.

SplunkTrust

Try this:

``````key=mycounter OR key=mytime | eval value_{key} = value | stats first(value_*) as * by id | eval result = mycounter / mytime
``````

The first `eval` creates two fields, `value_mycounter` and `value_mytime`. The `stats` merges the two events into one for each `id`. The final `eval` does the actual maths.

SplunkTrust

Gerne! 🙂

Explorer

Awesome! Thank you very much!

Get Updates on the Splunk Community!

#### Introducing the Splunk Community Dashboard Challenge!

Welcome to Splunk Community Dashboard Challenge! This is your chance to showcase your skills in creating ...

#### Get the T-shirt to Prove You Survived Splunk University Bootcamp

As if Splunk University, in Las Vegas, in-person, with three days of bootcamps and labs weren’t enough, now ...

#### Wondering How to Build Resiliency in the Cloud?

IT leaders are choosing Splunk Cloud as an ideal cloud transformation platform to drive business resilience,  ...