Splunk Search

Calculate percentage of multiple values, different events

evan_roggenkamp
Path Finder

I am trying to display the percentage of Total Modems against Total Modems on Card 0.

The XML I am given unfortunately breaks up data from essentially one event into three:

alt text

source="C:\\splunk_files\\summary.xml" host="OSSTEST01" index="prtg_cmts" sourcetype="PRTG_API" | rex "(<sensor>)(?<sensor>.*)<" | rex "(<group>)(?<group>.*)<" | rex "(<lastvalue>)(?<value>\d+)\s" | search group="Bertha/Hewitt CMTS" | table _time, group, sensor, value

I have tried running a sub search to get just total modem count, and then compare that to the count of the two other rows, using eventstats, but that was not successful.

0 Karma

somesoni2
Revered Legend

Try this

source="C:\\splunk_files\\summary.xml" host="OSSTEST01" index="prtg_cmts" sourcetype="PRTG_API" | rex "(<group>)(?<group>.*)<" | search group="Bertha/Hewitt CMTS"  | rex "(<sensor>)(?<sensor>.*)<" | rex "(<lastvalue>)(?<value>\d+)\s"  | table _time, group, sensor, value | eventstats sum(value) as Total by _time group | eval Percentage=round(value*100/Total,2)

Updated
If I'm not wrong, it easy to implement by just changing eventstats sum(.. to eventstats max(..

source="C:\\splunk_files\\summary.xml" host="OSSTEST01" index="prtg_cmts" sourcetype="PRTG_API" | rex "(<group>)(?<group>.*)<" | search group="Bertha/Hewitt CMTS"  | rex "(<sensor>)(?<sensor>.*)<" | rex "(<lastvalue>)(?<value>\d+)\s"  | table _time, group, sensor, value | eventstats max(value) as Total by _time group | eval Percentage=round(value*100/Total,2)
0 Karma

evan_roggenkamp
Path Finder

That is helpful. I maybe forgot to mention, the first row is actually the total and the values below it fractional representations of it (they add up to the total).

So in this case:
The first row has the total modems: 126
Upstream 5 has 86 modems online so it has 68% of the modems online
Upstream 6 has 40 modems online so it has 32% of the modems online

So there are 100% of the modems online. That is what I would like to represent in a single value field.

0 Karma
Get Updates on the Splunk Community!

Enterprise Security Content Update (ESCU) | New Releases

In January, the Splunk Threat Research Team had one release of new security content via the Splunk ES Content ...

Expert Tips from Splunk Professional Services, Ensuring Compliance, and More New ...

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

Observability Release Update: AI Assistant, AppD + Observability Cloud Integrations & ...

This month’s releases across the Splunk Observability portfolio deliver earlier detection and faster ...