Splunk Search

## Find the percentage between two fields from two sourcetypes

Path Finder

I have two sourcetypes - submitters, and recipient_group. I am looking to find the percentage of submitters that are in the recipient_group. If I have 500 submitters and 1000 recipients, my percentage would be 50%. The following search gives me the dc of users in each sourcetype, but I don't have the Splunk knowledge on how to retain those values so I can perform the math.

``````sourcetype = submitters OR sourcetype=recipient_group  | eval UserID{sourcetype}=UserID | stats dc(UserIDR*), dc(UserIDS*)
``````

Thanks everyone! Mike

Tags (2)
1 Solution
Path Finder

Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!

sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)

Path Finder

Figured it out. My issue was using the wildcard '*' in the dc command. When I used the entire name - poof!

sourcetype = submitters OR
sourcetype=recipient_group | eval
UserID{sourcetype}=UserID |stats
dc(eval(UserIDRecipient_Group)) as
USERR, dc(eval(UserIDSubmitters)) as
USERS | eval
percentage=(USERS/USERR*100)

Splunk Employee

what about starting with something like that, then calculate the ratio.
`sourcetype=submitters OR sourcetype=recipient_group | chart dc(UserID) by UserID sourcetype | eval in_both=if(submitters==1 AND recipient_group==1,1,0)`

Then do the total and clean, then eval a percentage
`... | addcoltotals | WHERE isnull(UserID) | table submitters recipient_group in_both`

Path Finder

yannK - Thanks for the response. To keep it simple, both of our sourcetypes only have one type of data in it. So a simple dc(userID) will give use the count needed to calculate the ratio. I just can't find a way to capture those values to do a calculation on them. I will keep tweaking the code and post back soon (hopefully). Mike

Get Updates on the Splunk Community!

#### .conf24 | Day 0

Hello Splunk Community! My name is Chris, and I'm based in Canberra, Australia's capital, and I travelled for ...

#### Enhance Security Visibility with Splunk Enterprise Security 7.1 through Threat ...

(view in My Videos)Struggling with alert fatigue, lack of context, and prioritization around security ...

#### Troubleshooting the OpenTelemetry Collector

In this tech talk, you’ll learn how to troubleshoot the OpenTelemetry collector - from checking the ...