I have two sourcetypes - submitters, and recipient_group. I am looking to find the percentage of submitters that are in the recipient_group. If I have 500 submitters and 1000 recipients, my percentage would be 50%. The following search gives me the dc of users in each sourcetype, but I don't have the Splunk knowledge on how to retain those values so I can perform the math.
sourcetype = submitters OR sourcetype=recipient_group | eval UserID{sourcetype}=UserID | stats dc(UserIDR*), dc(UserIDS*)
Thanks everyone! Mike
Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!
sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)
Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!
sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)
what about starting with something like that, then calculate the ratio.
sourcetype=submitters OR sourcetype=recipient_group | chart dc(UserID) by UserID sourcetype | eval in_both=if(submitters==1 AND recipient_group==1,1,0)
Then do the total and clean, then eval a percentage
... | addcoltotals | WHERE isnull(UserID) | table submitters recipient_group in_both
yannK - Thanks for the response. To keep it simple, both of our sourcetypes only have one type of data in it. So a simple dc(userID) will give use the count needed to calculate the ratio. I just can't find a way to capture those values to do a calculation on them. I will keep tweaking the code and post back soon (hopefully). Mike