Splunk Search

How do I divide my other results from one specific result?


Currently I have

index=* Name=rateA OR rateB OR rateC OR rateD OR rateE | stats sum(Rate) as sumRate by _time, Name

What I want to do is get the sumRate of all the other rates and then divide them by rateE 's sumRate. I tried doing an appencols to search for rateE separately and then do appendcols [search index=* Name=rateE | stats sum(Rate) as sumRateE by _time, Name ] | eval divided=sumRate/sumRateE but for some reason the time range of the appendcols search was only a fraction of the total time range.

0 Karma

Super Champion

try this:

index=* Name=rateA OR Name=rateB OR Name=rateC OR Name=rateD OR Name=rateE 
| stats sum(Rate) as sumRate, sum(eval(if(Name="rateE",Rate,0))) as sumRateE by _time 
| eventstats sum(sumRate) as sumRate sum(sumRateE) as sumRateE 
| eval divided=sumRate/sumRateE
0 Karma


Hi sorry I should I clarified in my questions, how do I then timechart the average divided for each name as a percent? When I try

... | eval divided=sumRate/sumRateE
| timechart avg(divided) as Percent by Name

I don't get anything showing up

0 Karma


Using the eval in the stats line I get both sumRateE and sumRate, then using eval to divide:

index=* Name=rateA OR rateB OR rateC OR rateD OR rateE 
| stats sum(Rate) as sumRate, sum(eval(if(like(Name,"rateE"),Rate,0))) as sumRateE by _time
| eval divided=sumRate/sumRateE
0 Karma
Get Updates on the Splunk Community!

Splunk Observability Cloud | Customer Survey!

If you use Splunk Observability Cloud, we invite you to share your valuable insights with us through a brief ...

Happy CX Day, Splunk Community!

Happy CX Day, Splunk Community! CX stands for Customer Experience, and today, October 3rd, is CX Day — a ...

.conf23 | Get Your Cybersecurity Defense Analyst Certification in Vegas

We’re excited to announce a new Splunk certification exam being released at .conf23! If you’re going to Las ...