Turn on suggestions

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

Splunk Search

Auto-suggest helps you quickly narrow down your search results by suggesting possible matches as you type.

Showing results for

- Community
- :
- Splunk Answers
- :
- Using Splunk
- :
- Splunk Search
- :
- How To Get = sum(set A events) / sum (set B events...

- Subscribe to RSS Feed
- Mark Topic as New
- Mark Topic as Read
- Float this Topic for Current User
- Bookmark
- Subscribe
- Mute
- Printer Friendly Page

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

How To Get = sum(set A events) / sum (set B events).

htkwan

Path Finder

08-20-2015
05:48 PM

Hello,

I'm new to splunk. I need to evaluate result = sum(set A events) / sum (set B events). I've tried:

sourcetype="rtdata" Category1="CLC" ID2="TOTAL*CHW*LOAD" | stats sum(Value) as Total*Load | append [ search sourcetype="rtdata" ID2="TOTAL*CH*KW" | stats sum(Value) as Total*KW ] \

I'm stuck. How do I evaluate the = Total*KW / Total*Load? Pls. advise. Thanks

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How To Get = sum(set A events) / sum (set B events).

richgalloway

SplunkTrust

08-20-2015
08:53 PM

Try this

```
sourcetype="rtdata" Category1="CLC" ID2="TOTAL_CHW_LOAD" | stats sum(Value) as Total_Load | append [ search sourcetype="rtdata" ID2="TOTAL_CH_KW" | stats sum(Value) as Total_KW ] | eval x = Total_KW / Total_Load
```

---

If this reply helps you, an upvote would be appreciated.

If this reply helps you, an upvote would be appreciated.

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How To Get = sum(set A events) / sum (set B events).

acharlieh

Influencer

08-20-2015
10:02 PM

So you currently have 2 results each with a single value, you could take your existing search and append something like

```
... | stats first(*) as * | eval result = Total_KW / Total_Load
```

Here we use stats to get the first value for each field across all 2 results. Since how your search is constructed, the first value is guaranteed to have a Total*Load and not a Total*KW field and the second result produced by the append is exactly the opposite this works. Now with both fields on a single event we can use eval to calculate the ratio of the two numbers easily.

You can do similar without append like so:

```
sourcetype="rtdata" (Category1="CLC" ID2="TOTAL_CHW_LOAD") OR ID2="TOTAL_CH_KW" Value=* | eval x=1 | chart sum(Value) by x, ID2 | eval result = TOTAL_CH_KW / TOTAL_CHW_LOAD
```

Here we pull back all events in our base search, and create a dummy field with a common value. Using chart we get the statistics onto a single line (by the dummy field) and the other fields being named for the values of ID2. Again with a single result the ratio is simple

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How To Get = sum(set A events) / sum (set B events).

htkwan

Path Finder

08-20-2015
10:21 PM

Thanks for all your prompt help. My colleague has helped me. We've found the answer:

sourcetype="rtdata" Category1="CLC" ID2="TOTAL*CHW*LOAD" | stats sum(Value) as Total*Load | appendcols [ search Category1="CLC" sourcetype="rtdata" ID2="TOTAL*CH*KW" | stats sum(Value) as Total*KW ] | eval Total*Eff=Total*KW/Total*Load | eval ID="Total*CH*Eff" | table ID, Total*KW, Total*Load, Total*Eff

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How To Get = sum(set A events) / sum (set B events).

acharlieh

Influencer

08-20-2015
10:37 PM

Make sure to accept the answer that solved your issue (even if it's your own) to mark your question as solved. (Also if you felt any other's posts were particularly helpful in getting you to your solution here or elsewhere on the site, make sure to up vote them as well to show appreciation for good content)

Highlighted
##

- Mark as New
- Bookmark
- Subscribe
- Mute
- Subscribe to RSS Feed
- Permalink
- Email to a Friend
- Report Inappropriate Content

Re: How To Get = sum(set A events) / sum (set B events).

htkwan

Path Finder

08-21-2015
12:12 AM

Hello Acharlieh,

Noted.