How can I derive a field based on the existing two fields?

[newsplnkr]

Hello All,

I am new to Splunk, and in need of help for below events:

1. [testName="MobileExp",experience="FetchOn"]
2. [testName="MobileExp",experience="FetchOff"]
3. [testName="ProductDesign",experience="A"]
4. [testName="ProductDesign",experience="B"]
5. [testName="ProductDesign",experience="C"]
6. [testName="ProductDesign",experience="B"]
7. [testName="ProductDesign",experience="B"]

Using above events, I wanted to derive a field which would have percentage for each "experience" of a "testName". For example, for testName="MobileExp", there are two experiences, each of them appearing exactly once. So, percentage split for the experiences relating to testName="MobileExp" is 50%.

Thank you in advance!

[newsplnkr · Accepted solution]

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

[macadminrohit]

question: why you are deduping at the end ?

[newsplnkr]

I did it to remove any duplicate records

[skoelpin]

Accept the answer

[renjith_nair]

@newsplnkr ,

Try

"your base search "|eventstats count by testName,experience
|eventstats sum(count) as total by testName
|eval perc=round((count/total)*100,2)|fields - count,total

[newsplnkr]

Hi Renjith, unfortunately, the above query does not produce any results.

[macadminrohit]

Try this search, replace the base search as per your data :

| makeresults 
| eval Data="testName:MobileExp,experience:FetchOn;testName:MobileExp,experience:FetchOff;testName:ProductDesign,experience:A;testName:ProductDesign,experience:C;testName:ProductDesign,experience:B;testName:ProductDesign,experience:B" 
| makemv delim=";" Data 
| mvexpand Data 
| eval Split1=mvindex(split(Data,","),0) 
| eval Split2=mvindex(split(Data,","),1) | eval testName=mvindex(split(Split1,":"),1) | eval experience=mvindex(split(Split2,":"),1) | table _time testName experience | eventstats count as test_count by testName experience | eventstats sum(test_count) as Total by testName | eval perc=(test_count/Total*100)