Splunk Search

Eval division of two results of the same field

kokanne
Communicator

I want to find the ratio of failures and successful logins. Therefore I use one field in a data model, called Authentication.action. I'm using tstats.

I get two results, in a table.

Authentication.action - count
failure - 7511212
success - 1010802549

I want to use these results in an eval command to divide them between each other and find the ratio of successful logins to every failed login.

Is this possible?

0 Karma
1 Solution

harishalipaka
Motivator

hi @kokanne

try like this

if it is helpful pls accept this

|makeresults |eval Authentication="failure" ,count=7511212 | append [|makeresults |eval Authentication="success" ,count=1010802549 ] |table Authentication count 

|transpose header_field=Authentication |eval division=success/failure |transpose column_name=Authentication
Thanks
Harish

View solution in original post

0 Karma

harishalipaka
Motivator

hi @kokanne

try like this

if it is helpful pls accept this

|makeresults |eval Authentication="failure" ,count=7511212 | append [|makeresults |eval Authentication="success" ,count=1010802549 ] |table Authentication count 

|transpose header_field=Authentication |eval division=success/failure |transpose column_name=Authentication
Thanks
Harish
0 Karma

kokanne
Communicator

Also, these results are not always the same, so the hardcoded count value wouldn't work out

0 Karma

harishalipaka
Motivator

@kokanne

just add that snippet code at end of your query

Thanks
Harish
0 Karma

kokanne
Communicator

I see, how can I get the single value of the eval output?

0 Karma

harishalipaka
Motivator

@kokanne

just add |table columnname (which fields you want to display)

Thanks
Harish
0 Karma

kokanne
Communicator
| tstats summariesonly=true count from datamodel=Authentication by "Authentication.action" 
| search "Authentication.action"!="unknown" 
| transpose header_field=="Authentication.action" 
| eval division=success/failure 

Trying to only display division field, table division doesn't work

Edit: Found out what the problem was, it's fixed

0 Karma

kokanne
Communicator

Makeresults has to be the first command in the query, but that is already being used by tstats

0 Karma

kamlesh_vaghela
SplunkTrust
SplunkTrust

@kokanne

makeresults command is just for generating data for sample search.

just try this.

YOUR_TSTATS_SEARCH
|transpose header_field=="Authentication.action"  |eval division=success/failure  

OR

YOUR_TSTATS_SEARCH
|transpose header_field=="Authentication.action"  |eval division=success/failure |transpose column_name=Authentication
0 Karma
Get Updates on the Splunk Community!

Database Performance Sidebar Panel Now on APM Database Query Performance & Service ...

We’ve streamlined the troubleshooting experience for database-related service issues by adding a database ...

IM Landing Page Filter - Now Available

We’ve added the capability for you to filter across the summary details on the main Infrastructure Monitoring ...

Dynamic Links from Alerts to IM Navigators - New in Observability Cloud

Splunk continues to improve the troubleshooting experience in Observability Cloud with this latest enhancement ...