Splunk Search

Eval groupping

tahasefiani
Explorer

Hello,

This is my query

| loadjob savedsearch="myquery"
| where strftime(_time, "%Y-%m-%d") >= "2020-02-26"
| stats dc(eval(if((STEP=="show"),ID_RF_ATOS,NULL))) AS show,
 dc(eval(if((STEP=="clic"),ID_RF_ATOS,NULL))) AS clic,
 dc(eval(if((STEP=="send"),ID_RF_ATOS,NULL))) AS send by company,city 
| where show>0
| stats sum(show) AS show,sum(clic) AS clic,sum(send) AS send by city
| eval rate= round(((show - (clic+send))/show*100),2)." %"
| table city,show,clic,send,rate

I want to calculate the rate by city and add it to the table

0 Karma

to4kawa
Ultra Champion

you already calculate. what's wrong?

0 Karma

tahasefiani
Explorer

i don't know what was the problem but now it's works 🙂

0 Karma

to4kawa
Ultra Champion

I close your question. OK?

0 Karma

tahasefiani
Explorer

yes please

0 Karma
Career Survey
First 500 qualified respondents will receive a $20 gift card! Tell us about your professional Splunk journey.
Get Updates on the Splunk Community!

Tech Talk Recap | Mastering Threat Hunting

Mastering Threat HuntingDive into the world of threat hunting, exploring the key differences between ...

Observability for AI Applications: Troubleshooting Latency

If you’re working with proprietary company data, you’re probably going to have a locally hosted LLM or many ...

Splunk AI Assistant for SPL vs. ChatGPT: Which One is Better?

In the age of AI, every tool promises to make our lives easier. From summarizing content to writing code, ...