Splunk Search

Divide the results of a query based on a field in the log

SG
Path Finder

Hi,

I wanted to divide each hostname by using the count of "documentcompletetime" field.

 

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| chart count(url) by hostname

 

The output of the query is as below...

SG_0-1622115247907.png

 

The count(url) column I wanted to divide with the count of "documentcompletetime" field. This field is available in the events, screenshot for the same

SG_1-1622115362565.png

I wanted to divide each and every value of count(url) column with "documentcompletetime" count which is 48 in this example. documentcompletetime value is not a static value. The value changes based on the test timings. Can you guys please help?

Labels (1)
Tags (1)
0 Karma
1 Solution

aasabatini
Motivator

Hi @SG 

got it!

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| eventstats dc(documentcompletetime) as documentcompletetime
| stats count(url) as count values(documentcompletetime) as documentcompletetime by hostname
| eval division=count/documentcompletetime
| table hostname count documentcompletetime division
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

View solution in original post

aasabatini
Motivator

Hi @SG 

can you show the values of the documentcompletetime field?

also did you try this?

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| chart count(url) by hostname documentcompletetime
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”
0 Karma

SG
Path Finder

@aasabatini 

With the query provided by you, i am just getting the count of url by host name

hostnameNULL
cdn.appdynamics.com47
digitalcontent.api.tesco.com658
o505202.ingest.sentry.io61
pdx-col.eum-appdynamics.com1
smetrics.tesco.com47
www.bing.com705
www.googletagmanager.com49
www.***.com686

 

I also wanted to divide each and every value in the null column with the count of "documentcompletetime" .

For example 

hostnameNULLdocumentcompletetimecount(url)
cdn.appdynamics.com47480.979167
digitalcontent.api.tesco.com6584813.70833
o505202.ingest.sentry.io61481.270833
pdx-col.eum-appdynamics.com1480.020833
smetrics.tesco.com47480.979167
www.bing.com7054814.6875
www.googletagmanager.com49481.020833
www.**.com6864814.29167
0 Karma

aasabatini
Motivator

Hi @SG 

got it!

index=nextgen sourcetype=lighthouse_json sourcetype=lighthouse_json datasource=webpagetest step="Homepage"
| eventstats dc(documentcompletetime) as documentcompletetime
| stats count(url) as count values(documentcompletetime) as documentcompletetime by hostname
| eval division=count/documentcompletetime
| table hostname count documentcompletetime division
“The answer is out there, Neo, and it’s looking for you, and it will find you if you want it to.”

SG
Path Finder

Thanks to @aasabatini  for the response, this is what i was looking for

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...