Splunk Search

How can I derive a field based on the existing two fields?

newsplnkr
Explorer

Hello All,

I am new to Splunk, and in need of help for below events:

  1. [testName="MobileExp",experience="FetchOn"]
  2. [testName="MobileExp",experience="FetchOff"]
  3. [testName="ProductDesign",experience="A"]
  4. [testName="ProductDesign",experience="B"]
  5. [testName="ProductDesign",experience="C"]
  6. [testName="ProductDesign",experience="B"]
  7. [testName="ProductDesign",experience="B"]

Using above events, I wanted to derive a field which would have percentage for each "experience" of a "testName". For example, for testName="MobileExp", there are two experiences, each of them appearing exactly once. So, percentage split for the experiences relating to testName="MobileExp" is 50%.

Thank you in advance!

Tags (1)
0 Karma
1 Solution

newsplnkr
Explorer

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

View solution in original post

0 Karma

newsplnkr
Explorer

I figured out the answer with the help of @renjith.nair.

The following worked:

"baseSearch"
| eventstats count as testCount by testName
| eventstats count as expTotal by experience
| eval trafficSplit=round((expTotal/testCount)*100,1) | fields - expTotal, testCount
| table testName experience trafficSplit | dedup testName experience trafficSplit

0 Karma

macadminrohit
Contributor

question: why you are deduping at the end ?

0 Karma

newsplnkr
Explorer

I did it to remove any duplicate records

0 Karma

skoelpin
SplunkTrust
SplunkTrust

Accept the answer

0 Karma

renjith_nair
Legend

@newsplnkr ,

Try

"your base search "|eventstats count by testName,experience
|eventstats sum(count) as total by testName
|eval perc=round((count/total)*100,2)|fields - count,total
---
What goes around comes around. If it helps, hit it with Karma 🙂

newsplnkr
Explorer

Hi Renjith, unfortunately, the above query does not produce any results.

0 Karma

macadminrohit
Contributor

Try this search, replace the base search as per your data :

| makeresults 
| eval Data="testName:MobileExp,experience:FetchOn;testName:MobileExp,experience:FetchOff;testName:ProductDesign,experience:A;testName:ProductDesign,experience:C;testName:ProductDesign,experience:B;testName:ProductDesign,experience:B" 
| makemv delim=";" Data 
| mvexpand Data 
| eval Split1=mvindex(split(Data,","),0) 
| eval Split2=mvindex(split(Data,","),1) | eval testName=mvindex(split(Split1,":"),1) | eval experience=mvindex(split(Split2,":"),1) | table _time testName experience | eventstats count as test_count by testName experience | eventstats sum(test_count) as Total by testName | eval perc=(test_count/Total*100)
0 Karma
Get Updates on the Splunk Community!

Dashboards: Hiding charts while search is being executed and other uses for tokens

There are a couple of features of SimpleXML / Classic dashboards that can be used to enhance the user ...

Splunk Observability Cloud's AI Assistant in Action Series: Explaining Metrics and ...

This is the fourth post in the Splunk Observability Cloud’s AI Assistant in Action series that digs into how ...

Brains, Bytes, and Boston: Learn from the Best at .conf25

When you think of Boston, you might picture colonial charm, world-class universities, or even the crack of a ...