Splunk Search

How do I divide my other results from one specific result?

Explorer

Currently I have

index=* Name=rateA OR rateB OR rateC OR rateD OR rateE | stats sum(Rate) as sumRate by _time, Name

What I want to do is get the sumRate of all the other rates and then divide them by rateE 's sumRate. I tried doing an appencols to search for rateE separately and then do appendcols [search index=* Name=rateE | stats sum(Rate) as sumRateE by _time, Name ] | eval divided=sumRate/sumRateE but for some reason the time range of the appendcols search was only a fraction of the total time range.

0 Karma

SplunkTrust
SplunkTrust

try this:

index=* Name=rateA OR Name=rateB OR Name=rateC OR Name=rateD OR Name=rateE 
| stats sum(Rate) as sumRate, sum(eval(if(Name="rateE",Rate,0))) as sumRateE by _time 
| eventstats sum(sumRate) as sumRate sum(sumRateE) as sumRateE 
| eval divided=sumRate/sumRateE
0 Karma

Explorer

Hi sorry I should I clarified in my questions, how do I then timechart the average divided for each name as a percent? When I try

... | eval divided=sumRate/sumRateE
| timechart avg(divided) as Percent by Name

I don't get anything showing up

0 Karma

Builder

Using the eval in the stats line I get both sumRateE and sumRate, then using eval to divide:

index=* Name=rateA OR rateB OR rateC OR rateD OR rateE 
| stats sum(Rate) as sumRate, sum(eval(if(like(Name,"rateE"),Rate,0))) as sumRateE by _time
| eval divided=sumRate/sumRateE
0 Karma
State of Splunk Careers

Access the Splunk Careers Report to see real data that shows how Splunk mastery increases your value and job satisfaction.

Find out what your skills are worth!