Splunk Search

How do I perform math against two searches?

mo86
New Member

I have two searches that use the same index and each return a numerical total, differing only in the period of time of the data they look at. How would I perform math on the search results for example adding or calculating percentages?

0 Karma
1 Solution

inventsekar
Super Champion
| makeresults
| fields - _time
| eval Total1=[search index=data NOT ID="" earliest=-1d@d latest=-0d@d | regex name!="[a-z]."| dedup id | stats count | return $count] 
| eval Total2=[search index=data NOT ID="" earliest=-0d@d latest=now | regex name!="[a-z]."| dedup id | stats count | return $count]
| eval FullTotal=Total1+Total2 | eval percentage=((Total1/FullTotal)*100)
>>> Happy Splunking !

View solution in original post

inventsekar
Super Champion
| makeresults
| fields - _time
| eval Total1=[search index=data NOT ID="" earliest=-1d@d latest=-0d@d | regex name!="[a-z]."| dedup id | stats count | return $count] 
| eval Total2=[search index=data NOT ID="" earliest=-0d@d latest=now | regex name!="[a-z]."| dedup id | stats count | return $count]
| eval FullTotal=Total1+Total2 | eval percentage=((Total1/FullTotal)*100)
>>> Happy Splunking !

View solution in original post

mo86
New Member

Thank you, that works great!

0 Karma

inventsekar
Super Champion

maybe, could you write the 2 queries please..

>>> Happy Splunking !
0 Karma

mo86
New Member

index=data NOT ID="" earliest=-1d@d latest=-0d@d | regex name!="[a-z]."| dedup id | stats count

index=data NOT ID="" earliest=-0d@d latest=now | regex name!="[a-z]."| dedup id | stats count

0 Karma
Did you miss .conf21 Virtual?

Good news! The event's keynotes and many of its breakout sessions are now available online, and still totally FREE!