Splunk Search

Find the percentage between two fields from two sourcetypes

lehrfeld
Path Finder

I have two sourcetypes - submitters, and recipient_group. I am looking to find the percentage of submitters that are in the recipient_group. If I have 500 submitters and 1000 recipients, my percentage would be 50%. The following search gives me the dc of users in each sourcetype, but I don't have the Splunk knowledge on how to retain those values so I can perform the math.

sourcetype = submitters OR sourcetype=recipient_group  | eval UserID{sourcetype}=UserID | stats dc(UserIDR*), dc(UserIDS*)

Thanks everyone! Mike

0 Karma
1 Solution

lehrfeld
Path Finder

Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!

sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)

View solution in original post

0 Karma

lehrfeld
Path Finder

Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!

sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)

0 Karma

yannK
Splunk Employee
Splunk Employee

what about starting with something like that, then calculate the ratio.
sourcetype=submitters OR sourcetype=recipient_group | chart dc(UserID) by UserID sourcetype | eval in_both=if(submitters==1 AND recipient_group==1,1,0)

Then do the total and clean, then eval a percentage
... | addcoltotals | WHERE isnull(UserID) | table submitters recipient_group in_both

0 Karma

lehrfeld
Path Finder

yannK - Thanks for the response. To keep it simple, both of our sourcetypes only have one type of data in it. So a simple dc(userID) will give use the count needed to calculate the ratio. I just can't find a way to capture those values to do a calculation on them. I will keep tweaking the code and post back soon (hopefully). Mike

0 Karma
Get Updates on the Splunk Community!

.conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

 (view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

Troubleshooting the OpenTelemetry Collector

  In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...