Splunk Search

Count Fraction of Distinct events

viggor
Path Finder

I woudl like to know, per CountryId, what fraction of FooId equal to BarId

In the follwoing log:

MyEvent CountryId=1 FooId=63407020 BarId=82955997
MyEvent CountryId=1 FooId=63407020 BarId=63407020
MyEvent CountryId=2 FooId=65407020 BarId=207020

So the desired output would be:

CountryId=1 1/2
CountryId=2 0

In pseudo-Splunk Search this would look something along the lines of:
((count(MyEvent) | where FooId != BarId) / count(MyEvent)) by CountryId

But how would I write this query in actual Splunk syntax?

Tags (2)
0 Karma
1 Solution

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search giving fields CountryId FooId BarId | eval FooBarEqual=if(FooId=BarId,1,0)
| stats count as total sum(FooBarEqual) as FooBarEqual by CountryId | eval FoolBarEqual=FooBarEqual/total

View solution in original post

somesoni2
SplunkTrust
SplunkTrust

Try like this

your base search giving fields CountryId FooId BarId | eval FooBarEqual=if(FooId=BarId,1,0)
| stats count as total sum(FooBarEqual) as FooBarEqual by CountryId | eval FoolBarEqual=FooBarEqual/total
Get Updates on the Splunk Community!

Index This | I am a number, but when you add ‘G’ to me, I go away. What number am I?

March 2024 Edition Hayyy Splunk Education Enthusiasts and the Eternally Curious!  We’re back with another ...

What’s New in Splunk App for PCI Compliance 5.3.1?

The Splunk App for PCI Compliance allows customers to extend the power of their existing Splunk solution with ...

Extending Observability Content to Splunk Cloud

Register to join us !   In this Extending Observability Content to Splunk Cloud Tech Talk, you'll see how to ...