Splunk Search

How can I derive a field based on the existing two fields?

newsplnkr
Explorer

Hello All,

I am new to Splunk, and in need of help for below events:

  1. [testName="MobileExp",experience="FetchOn"]
  2. [testName="MobileExp",experience="FetchOff"]
  3. [testName="ProductDesign",experience="A"]
  4. [testName="ProductDesign",experience="B"]
  5. [testName="ProductDesign",experience="C"]
  6. [testName="ProductDesign",experience="B"]
  7. [testName="ProductDesign",experience="B"]

Using above events, I wanted to derive a field which would have percentage for each "experience" of a "testName". For example, for testName="MobileExp", there are two experiences, each of them appearing exactly once. So, percentage split for the experiences relating to testName="MobileExp" is 50%.

Thank you in advance!

Tags (1)
0 Karma
1 Solution

newsplnkr
Explorer

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

View solution in original post

0 Karma

newsplnkr
Explorer

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

0 Karma

macadminrohit
Contributor

question: why you are deduping at the end ?

0 Karma

newsplnkr
Explorer

I did it to remove any duplicate records

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Accept the answer

0 Karma

renjith_nair
Legend

@newsplnkr ,

Try

"your base search "|eventstats count by testName,experience
|eventstats sum(count) as total by testName
|eval perc=round((count/total)*100,2)|fields - count,total
---
What goes around comes around. If it helps, hit it with Karma 🙂

newsplnkr
Explorer

Hi Renjith, unfortunately, the above query does not produce any results.

0 Karma

macadminrohit
Contributor

Try this search, replace the base search as per your data :

| makeresults 
| eval Data="testName:MobileExp,experience:FetchOn;testName:MobileExp,experience:FetchOff;testName:ProductDesign,experience:A;testName:ProductDesign,experience:C;testName:ProductDesign,experience:B;testName:ProductDesign,experience:B" 
| makemv delim=";" Data 
| mvexpand Data 
| eval Split1=mvindex(split(Data,","),0) 
| eval Split2=mvindex(split(Data,","),1) | eval testName=mvindex(split(Split1,":"),1) | eval experience=mvindex(split(Split2,":"),1) | table _time testName experience | eventstats count as test_count by testName experience | eventstats sum(test_count) as Total by testName | eval perc=(test_count/Total*100)
0 Karma
Get Updates on the Splunk Community!

Splunk Answers Content Calendar, June Edition

Get ready for this week’s post dedicated to Splunk Dashboards! We're celebrating the power of community by ...

What You Read The Most: Splunk Lantern’s Most Popular Articles!

Splunk Lantern is a Splunk customer success center that provides advice from Splunk experts on valuable data ...

See your relevant APM services, dashboards, and alerts in one place with the updated ...

As a Splunk Observability user, you have a lot of data you have to manage, prioritize, and troubleshoot on a ...