Splunk Search

Calculating Kill / Death ratio in a game

khourihan_splun
Splunk Employee
Splunk Employee

I'd like to calculate K/D ratio for the game Insurgency.

I have two searches that can calculate #kills and number of deaths #killer

I'd like to calculate the ration of K v. D's.

index=insurgency  sourcetype="insurgency" killed 
| rex "killed \"(?<killed>.*?)<" 
| rex ":\s+\"(?<killer>.*?)<" 
| stats count by killer

alt text
alt text

alt text
alt text
I'd like the calculate the ration of Kills/Deaths. Any suggestions?

1 Solution

somesoni2
Revered Legend

Try this:

  index=insurgency sourcetype=insurgency | rex "killed \"(?<killed>.*?)<" 
   | rex ":\s+\"(?<killer>.*?)<"  | stats count by killer killed | appendpipe [ stats sum(count) as deaths by killed | rename killed as user ]
    | appendpipe [ stats sum(count) as kills by killer | rename killer as user ]| stats sum(deaths) as deaths sum(kills) as kills by user |fillnull value=0
    | eval ratio=if(deaths=0, kills,kills/deaths)

OR

 index=insurgency sourcetype=insurgency | rex "killed \"(?<killed>.*?)<" 
       | rex ":\s+\"(?<killer>.*?)<"  | eval Temp=killed.",Death ".killer.",Kill" | makemv Temp| table Temp| mvexpand Temp| rex field=Temp "(?<User>.*),(?<Action>.*)" | chart count over User by Action | eval ratio=if(Death=0, Kill,Kill/Death)

View solution in original post

somesoni2
Revered Legend

Try this:

  index=insurgency sourcetype=insurgency | rex "killed \"(?<killed>.*?)<" 
   | rex ":\s+\"(?<killer>.*?)<"  | stats count by killer killed | appendpipe [ stats sum(count) as deaths by killed | rename killed as user ]
    | appendpipe [ stats sum(count) as kills by killer | rename killer as user ]| stats sum(deaths) as deaths sum(kills) as kills by user |fillnull value=0
    | eval ratio=if(deaths=0, kills,kills/deaths)

OR

 index=insurgency sourcetype=insurgency | rex "killed \"(?<killed>.*?)<" 
       | rex ":\s+\"(?<killer>.*?)<"  | eval Temp=killed.",Death ".killer.",Kill" | makemv Temp| table Temp| mvexpand Temp| rex field=Temp "(?<User>.*),(?<Action>.*)" | chart count over User by Action | eval ratio=if(Death=0, Kill,Kill/Death)

khourihan_splun
Splunk Employee
Splunk Employee

both these queries worked. thanks somesoni2! and thanks Lisa !!

0 Karma

khourihan_splun
Splunk Employee
Splunk Employee

Hey Lisa,
Thanks, here's what that yielded:

alt text

0 Karma

lguinn2
Legend

Why not

index=insurgency  sourcetype="insurgency" killed 
| rex "killed \"(?<killed>.*?)<" 
| rex ":\s+\"(?<killer>.*?)<" 
| stats count by killer killed
| appendpipe [ stats count as deaths by killed | rename killed as user ]
| appendpipe [ stats count as kills by killer | rename killer as user ]
| stats sum(deaths) as deaths sum(kills) as kills by user
| eval ratio=kills/deaths

There may be a better way, but I just can't think of it.

khourihan_splun
Splunk Employee
Splunk Employee

your correction fixed it. nice job thanks!

0 Karma

yannK
Splunk Employee
Splunk Employee

Splunk all the GAMES LOGS !!!!!!

lguinn2
Legend

Found a typo - I have updated the answer above!

0 Karma

khourihan_splun
Splunk Employee
Splunk Employee

Thanks Lisa,
Sadly this didn't work. I will show the output of the search in the next box.

0 Karma
Get Updates on the Splunk Community!

Improve Your Security Posture

Watch NowImprove Your Security PostureCustomers are at the center of everything we do at Splunk and security ...

Maximize the Value from Microsoft Defender with Splunk

 Watch NowJoin Splunk and Sens Consulting for this Security Edition Tech TalkWho should attend:  Security ...

This Week's Community Digest - Splunk Community Happenings [6.27.22]

Get the latest news and updates from the Splunk Community here! News From Splunk Answers ✍️ Splunk Answers is ...